Security gateway and network data interaction method

Abstract

The invention discloses a security gateway and a network data interaction method, and relates to the field of network data interaction, and the method comprises a data capturing step, a data packet abnormity analysis step, a network environment monitoring step, a preliminary analysis step and a comprehensive analysis step. The network change corresponding to the data packet transmission process and the actual content of the data packet are monitored and acquired, and a data technology associated with depth is provided for the security judgment of the data packet. The network change corresponding to the data packet transmission process and the actual content of the data packet are organically and scientifically analyzed to obtain the data packet comprehensive abnormal coefficient corresponding to the data packet, and the security of the data packet is judged according to the data packet comprehensive abnormal coefficient corresponding to the data packet. The accuracy of data packet security judgment is greatly improved, and the network security is protected.

Description

Technical Field

[0001] The present application relates to the field of network data interaction, and in particular to a security gateway and a network data interaction method. Background Art

[0002] With the development of network technology, packet monitoring plays an increasingly critical role, helping organizations cope with increasingly complex network environments and security challenges. Packet monitoring is an important means to ensure network security, optimize performance, improve user experience and support business decisions. However, existing technologies still have the following shortcomings: The existing technology uses a single basis for security judgment on data packets, usually only analyzing and judging based on one or two types of data, which makes the security judgment of the data packet incomplete, and indirectly reduces the accuracy and effectiveness of the security judgment of the data packet, which is not conducive to protecting network security. Summary of the invention

[0003] The object of the present invention is to provide a security gateway and a network data interaction method to solve the problems raised in the above background technology.

[0004] To achieve the above object, the present invention provides the following technical solutions: A network data interaction method, comprising: Data capture step: Capture data packets of network transmission data to obtain a data packet set corresponding to the target network and data information corresponding to the data packet set; Data packet anomaly analysis step: used to perform preliminary analysis on the data information corresponding to the data packet set to obtain a first data packet anomaly coefficient corresponding to each data packet in the data packet set; Network environment monitoring step: used to monitor the network environment status corresponding to the target network and obtain the network quality information corresponding to the target network; Preliminary analysis step: for performing combined analysis based on data information corresponding to the data packet set and network quality information corresponding to the target network, to obtain a second abnormal coefficient of the data packet corresponding to each data packet in the data packet set; Comprehensive analysis step: used to parse and identify the content of the data packets corresponding to each data packet, and conduct a comprehensive analysis based on the first anomaly coefficient and the second anomaly coefficient of the data packet corresponding to each data packet in the data packet set to obtain the data packet security assessment result corresponding to the target network.

[0005] In a preferred embodiment of the present invention, the data capture step is specifically performed as follows: By setting up a listening device in the network, all data packets passing through the gateway are captured, and a data packet set corresponding to the target network is established based on all data packets passing through the gateway; Analyze the behavior pattern of the data packet through the data packet behavior pattern analysis component in the security gateway to obtain data information corresponding to the data packet set, wherein the data information includes the initial transmission time, the end transmission time, the data packet size and the transmission interval between two adjacent data packets in the data packet set corresponding to each data packet in the data packet set; The time period between the initial transmission time and the final transmission time corresponding to each data packet is recorded as the actual transmission time corresponding to each data packet; The frequency of data packet transmission in the target network within a corresponding unit time is obtained by counting the initial transmission time, the end transmission time and the transmission duration corresponding to each data packet.

[0006] In a preferred embodiment of the present invention, the specific implementation method of the data packet anomaly analysis step is as follows: Establish a data extraction relationship between the data packet anomaly analysis step and the database, extract the basic network performance parameter model corresponding to the target network stored in the database, extract each data packet transmission model corresponding to the target network stored in the database, wherein the data packet transmission model includes the basic network performance parameter model, the maximum data packet sending frequency, the data packet size, and the standard transmission duration corresponding to each size of data packet, obtain the maximum data packet sending frequency of the target network by screening the basic network performance parameter model corresponding to the target network, and obtain the standard transmission duration corresponding to each data packet in the data packet set corresponding to the target network by screening the data packet size of each data packet; By calculating the formula , calculate the first abnormal coefficient of each data packet in the data packet set ,in , They are respectively represented as the packet sending frequency and the maximum packet sending frequency of the target network in the corresponding unit time. , They are respectively represented as the actual transmission time and standard transmission time corresponding to each data packet in the data packet set corresponding to the target network. , They are respectively represented by the preset data packet sending frequency and the sending abnormal conversion factor and the first impact coefficient of data packet transmission, Represents the number of each data packet in the data packet set.

[0007] In the preferred embodiment of this scheme, the specific implementation method of the network environment monitoring step is as follows: The network environment of the target network is monitored through the preset network monitoring component to obtain the network quality information corresponding to the target network, where the network quality information includes the network traffic change curve over time, the network delay change curve over time, the network jitter change curve over time and the packet loss rate change curve over time.

[0008] In the preferred embodiment of this scheme, the specific implementation method of the preliminary analysis step is as follows: The network flow variation curve over time, the network delay variation curve over time, the network jitter variation curve over time and the packet loss rate variation curve over time are intercepted by using the initial transmission time and the termination transmission time corresponding to each data packet in the data packet set, so as to obtain the network flow curve segment, the network delay curve segment, the network jitter curve segment and the packet loss rate curve segment corresponding to each data packet in the data packet set; Extract the network traffic curve segment corresponding to each data packet in the data packet set to obtain the network traffic peak value corresponding to the transmission time of each data packet in the data packet set , Network traffic average and network traffic peaks ; Extract the network delay curve segment corresponding to each data packet in the data packet set to obtain the network delay peak value corresponding to the transmission time of each data packet in the data packet set , Average network delay and network latency spikes ; Extract the network jitter curve segment corresponding to each data packet in the data packet set to obtain the corresponding network jitter peak value during the transmission time of each data packet in the data packet set , Network jitter average and network jitter peak ; Extract the packet loss rate curve segment corresponding to each data packet in the data packet set to obtain the packet loss rate peak value corresponding to the transmission time of each data packet in the data packet set , Average packet loss rate and peak packet loss rate ; By calculating the formula , calculate the network traffic anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the network delay anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the network jitter anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the packet loss rate anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the second anomaly coefficient of each data packet in the data packet set ,in , , , They are respectively expressed as network traffic weight factor, network delay weight factor, network jitter weight factor and packet loss rate weight factor. , , , They are respectively represented by the preset network traffic anomaly coefficient influencing factor, network delay anomaly coefficient influencing factor, network jitter anomaly coefficient influencing factor and packet loss rate anomaly coefficient influencing factor, It is represented by the preset second abnormal coefficient influencing factor of the data packet.

[0009] In the preferred embodiment of this scheme, the specific implementation method of the comprehensive analysis step is as follows: Establishing a data extraction relationship between the comprehensive analysis step and the database, extracting each threat content corresponding to each threat level and the threat coefficient corresponding to each threat level stored in the database; Parsing each data packet in the data packet set by a preset data packet parsing method to obtain a sub-content set corresponding to each data packet in the data packet set; Compare and match each sub-content in the sub-content set corresponding to each data packet with each threat content corresponding to each threat level, and obtain a threat identification set and an unknown identification set of the sub-content set corresponding to each data packet, wherein the threat identification set refers to the sub-content in the sub-content set that can be matched with each threat content corresponding to each threat level, and the unknown identification set refers to the sub-content in the sub-content set corresponding to each data packet that cannot be identified and matched with each threat content corresponding to each threat level; By calculating the formula , calculate and obtain the third abnormal coefficient of each data packet in the data packet set ,in It is expressed as the number of sub-contents corresponding to each preset threat level. It is expressed as the threat coefficient corresponding to each threat level, It is represented by the preset third abnormal coefficient influencing factor of the data packet, It is represented by the number of each threat level. the number of species expressed as threat level; By calculating the formula , calculate and obtain the comprehensive anomaly coefficient of each data packet in the data packet set ,in It is expressed as a preset data packet comprehensive anomaly coefficient influencing factor; The comprehensive data packet anomaly coefficient corresponding to each data packet in the data packet set is compared and analyzed with the preset comprehensive data packet anomaly coefficient threshold. If the comprehensive data packet anomaly coefficient corresponding to each data packet is less than or equal to the preset comprehensive data packet anomaly coefficient threshold, it means that each data packet is safe and normal, and the safety and normality of each data packet is recorded as the data packet security assessment result corresponding to the target network. If the comprehensive data packet anomaly coefficient corresponding to a data packet is greater than the preset comprehensive data packet anomaly coefficient threshold, it means that the data packet is unsafe, and the unsafe data packets corresponding to the data packet set are obtained by statistics, and the unsafe data packets corresponding to the data packet set are recorded as the data packet security assessment result corresponding to the target network.

[0010] To achieve the above object, the present invention also provides the following technical solution: a security gateway device, comprising the following steps: Capture data packets of network transmission data to obtain a data packet set corresponding to the target network and data information corresponding to the data packet set; Performing a preliminary analysis on the data information corresponding to the data packet set to obtain a first data packet anomaly coefficient corresponding to each data packet in the data packet set; Monitor the network environment status corresponding to the target network and obtain the network quality information corresponding to the target network; According to the data information corresponding to the data packet set and the network quality information corresponding to the target network, a combined analysis is performed to obtain a second abnormal coefficient of the data packet corresponding to each data packet in the data packet set; The data packets corresponding to each data packet are parsed and content identified, and a comprehensive analysis is performed based on the first anomaly coefficient and the second anomaly coefficient of each data packet in the data packet set to obtain the data packet security assessment result corresponding to the target network.

[0011] Compared with the prior art, the present invention has the following beneficial effects: The present invention monitors and obtains the transmission process of the data packet, the network changes corresponding to the transmission process of the data packet, and the actual content of the data packet, and provides relevant and in-depth data technology for the security judgment of the data packet, thereby indirectly improving the accuracy of the security judgment of the data packet; The present invention obtains a comprehensive data packet anomaly coefficient corresponding to the data packet by performing an organic and scientific analysis on the data packet transmission process, the network changes corresponding to the data packet transmission process, and the actual content of the data packet, and judges the security of the data packet based on the comprehensive data packet anomaly coefficient corresponding to the data packet, thereby greatly improving the accuracy of the data packet security judgment and being beneficial to protecting network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0013] Figure 1 It is a schematic diagram of the connection steps of an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] See also Figure 1 The present invention provides a network data interaction method, which includes a data capture step, a data packet anomaly analysis step, a network environment monitoring step, a preliminary analysis step and a comprehensive analysis step: The data capture step is connected with the data packet anomaly analysis step, the data packet anomaly analysis step is connected with the comprehensive analysis step, the network environment monitoring step is connected with the preliminary analysis step, and the preliminary analysis step is connected with the comprehensive analysis step.

[0016] The data capture step captures data packets of network transmission data to obtain a data packet set corresponding to the target network and data information corresponding to the data packet set; Furthermore, the specific execution method of the data capture step is as follows: By setting up a listening device in the network, all data packets passing through the gateway are captured, and a data packet set corresponding to the target network is established based on all data packets passing through the gateway; Analyze the behavior pattern of the data packet through the data packet behavior pattern analysis component in the security gateway to obtain data information corresponding to the data packet set, wherein the data information includes the initial transmission time, the end transmission time, the data packet size and the transmission interval between two adjacent data packets in the data packet set corresponding to each data packet in the data packet set; The time period between the initial transmission time and the final transmission time corresponding to each data packet is recorded as the actual transmission time corresponding to each data packet; The frequency of data packet transmission in the target network within a corresponding unit time is obtained by counting the initial transmission time, the end transmission time and the transmission duration corresponding to each data packet.

[0017] The data packet anomaly analysis step is used to perform a preliminary analysis on the data information corresponding to the data packet set to obtain a first data packet anomaly coefficient corresponding to each data packet in the data packet set; Furthermore, the specific execution method of the data packet anomaly analysis step is as follows: Establish a data extraction relationship between the data packet anomaly analysis step and the database, extract the basic network performance parameter model corresponding to the target network stored in the database, extract each data packet transmission model corresponding to the target network stored in the database, wherein the data packet transmission model includes the basic network performance parameter model, the maximum data packet sending frequency, the data packet size, and the standard transmission duration corresponding to each size of data packet, obtain the maximum data packet sending frequency of the target network by screening the basic network performance parameter model corresponding to the target network, and obtain the standard transmission duration corresponding to each data packet in the data packet set corresponding to the target network by screening the data packet size of each data packet; By calculating the formula , calculate the first abnormal coefficient of each data packet in the data packet set ,in , They are respectively represented as the packet sending frequency and the maximum packet sending frequency of the target network in the corresponding unit time. , They are respectively represented as the actual transmission time and standard transmission time corresponding to each data packet in the data packet set corresponding to the target network. , They are respectively represented by the preset data packet sending frequency and the sending abnormal conversion factor and the first impact coefficient of data packet transmission, Represents the number of each data packet in the data packet set.

[0018] The network environment monitoring step is used to monitor the network environment status corresponding to the target network and obtain the network quality information corresponding to the target network; Furthermore, the specific implementation method of the network environment monitoring step is as follows: The network environment of the target network is monitored through the preset network monitoring component to obtain the network quality information corresponding to the target network, where the network quality information includes the network traffic change curve over time, the network delay change curve over time, the network jitter change curve over time and the packet loss rate change curve over time.

[0019] The preliminary analysis step is used to perform a combined analysis based on the data information corresponding to the data packet set and the network quality information corresponding to the target network to obtain the data packet second abnormality coefficient corresponding to each data packet in the data packet set; Furthermore, the specific implementation of the preliminary analysis step is as follows: The network flow variation curve over time, the network delay variation curve over time, the network jitter variation curve over time and the packet loss rate variation curve over time are intercepted by using the initial transmission time and the termination transmission time corresponding to each data packet in the data packet set, so as to obtain the network flow curve segment, the network delay curve segment, the network jitter curve segment and the packet loss rate curve segment corresponding to each data packet in the data packet set; Extract the network traffic curve segment corresponding to each data packet in the data packet set to obtain the network traffic peak value corresponding to the transmission time of each data packet in the data packet set , Network traffic average and network traffic peaks ; Extract the network delay curve segment corresponding to each data packet in the data packet set to obtain the network delay peak value corresponding to the transmission time of each data packet in the data packet set , Average network delay and network latency spikes ; Extract the network jitter curve segment corresponding to each data packet in the data packet set to obtain the corresponding network jitter peak value during the transmission time of each data packet in the data packet set , Network jitter average and network jitter peak ; Extract the packet loss rate curve segment corresponding to each data packet in the data packet set to obtain the packet loss rate peak value corresponding to the transmission time of each data packet in the data packet set , Average packet loss rate and peak packet loss rate ; By calculating the formula , calculate the network traffic anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the network delay anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the network jitter anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the packet loss rate anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the second anomaly coefficient of each data packet in the data packet set ,in , , , They are respectively expressed as network traffic weight factor, network delay weight factor, network jitter weight factor and packet loss rate weight factor. , , , They are respectively represented by the preset network traffic anomaly coefficient influencing factor, network delay anomaly coefficient influencing factor, network jitter anomaly coefficient influencing factor and packet loss rate anomaly coefficient influencing factor, It is represented by the preset second abnormal coefficient influencing factor of the data packet.

[0020] The comprehensive analysis step is used to parse and identify the content of the data packets corresponding to each data packet, and to perform a comprehensive analysis based on the first anomaly coefficient and the second anomaly coefficient of the data packet corresponding to each data packet in the data packet set to obtain the data packet security assessment result corresponding to the target network.

[0021] Furthermore, the specific implementation of the comprehensive analysis step is as follows: Establishing a data extraction relationship between the comprehensive analysis step and the database, extracting each threat content corresponding to each threat level and the threat coefficient corresponding to each threat level stored in the database; Parsing each data packet in the data packet set by a preset data packet parsing method to obtain a sub-content set corresponding to each data packet in the data packet set; Compare and match each sub-content in the sub-content set corresponding to each data packet with each threat content corresponding to each threat level, and obtain a threat identification set and an unknown identification set of the sub-content set corresponding to each data packet, wherein the threat identification set refers to the sub-content in the sub-content set that can be matched with each threat content corresponding to each threat level, and the unknown identification set refers to the sub-content in the sub-content set corresponding to each data packet that cannot be identified and matched with each threat content corresponding to each threat level; By calculating the formula , calculate and obtain the third abnormal coefficient of each data packet in the data packet set ,in It is expressed as the number of sub-contents corresponding to each preset threat level. It is expressed as the threat coefficient corresponding to each threat level, It is represented by the preset third abnormal coefficient influencing factor of the data packet, It is represented by the number of each threat level. the number of species expressed as threat level; By calculating the formula , calculate and obtain the comprehensive anomaly coefficient of each data packet in the data packet set ,in It is expressed as a preset data packet comprehensive anomaly coefficient influencing factor; The comprehensive data packet anomaly coefficient corresponding to each data packet in the data packet set is compared and analyzed with the preset comprehensive data packet anomaly coefficient threshold. If the comprehensive data packet anomaly coefficient corresponding to each data packet is less than or equal to the preset comprehensive data packet anomaly coefficient threshold, it means that each data packet is safe and normal, and the safety and normality of each data packet is recorded as the data packet security assessment result corresponding to the target network. If the comprehensive data packet anomaly coefficient corresponding to a data packet is greater than the preset comprehensive data packet anomaly coefficient threshold, it means that the data packet is unsafe, and the unsafe data packets corresponding to the data packet set are obtained by statistics, and the unsafe data packets corresponding to the data packet set are recorded as the data packet security assessment result corresponding to the target network.

[0022] To achieve the above object, the present invention also provides the following technical solution: a security gateway device, comprising the following steps: Capture data packets of network transmission data to obtain a data packet set corresponding to the target network and data information corresponding to the data packet set; Performing a preliminary analysis on the data information corresponding to the data packet set to obtain a first data packet anomaly coefficient corresponding to each data packet in the data packet set; Monitor the network environment status corresponding to the target network and obtain the network quality information corresponding to the target network; According to the data information corresponding to the data packet set and the network quality information corresponding to the target network, a combined analysis is performed to obtain a second abnormal coefficient of the data packet corresponding to each data packet in the data packet set; The data packets corresponding to each data packet are parsed and content identified, and a comprehensive analysis is performed based on the first anomaly coefficient and the second anomaly coefficient of each data packet in the data packet set to obtain the data packet security assessment result corresponding to the target network.

[0023] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A network data interaction method, characterized in that: include: Data capture step: Capture data packets of network transmission data to obtain a data packet set corresponding to the target network and data information corresponding to the data packet set; Data packet anomaly analysis step: used to perform preliminary analysis on the data information corresponding to the data packet set to obtain a first data packet anomaly coefficient corresponding to each data packet in the data packet set; Network environment monitoring step: used to monitor the network environment status corresponding to the target network and obtain the network quality information corresponding to the target network; Preliminary analysis step: for performing combined analysis based on data information corresponding to the data packet set and network quality information corresponding to the target network, to obtain a second abnormal coefficient of the data packet corresponding to each data packet in the data packet set; Comprehensive analysis step; used to parse and identify the content of the data packets corresponding to each data packet, and conduct a comprehensive analysis based on the first anomaly coefficient and the second anomaly coefficient of the data packet corresponding to each data packet in the data packet set to obtain the data packet security assessment result corresponding to the target network.

2. A network data interaction method according to claim 1, characterized in that: The specific execution method of the data capture step is as follows: By setting up a listening device in the network, all data packets passing through the gateway are captured, and a data packet set corresponding to the target network is established based on all data packets passing through the gateway; Analyze the behavior pattern of the data packet through the data packet behavior pattern analysis component in the security gateway to obtain data information corresponding to the data packet set, wherein the data information includes the initial transmission time, the end transmission time, the data packet size and the transmission interval between two adjacent data packets in the data packet set corresponding to each data packet in the data packet set; The time period between the initial transmission time and the final transmission time corresponding to each data packet is recorded as the actual transmission time corresponding to each data packet; The frequency of data packet transmission in the target network within a corresponding unit time is obtained by counting the initial transmission time, the end transmission time and the transmission duration corresponding to each data packet.

3. A network data interaction method according to claim 2, characterized in that: The specific implementation method of the data packet anomaly analysis step is as follows: Establish a data extraction relationship between the data packet anomaly analysis step and the database, extract the basic network performance parameter model corresponding to the target network stored in the database, extract each data packet transmission model corresponding to the target network stored in the database, wherein the data packet transmission model includes the basic network performance parameter model, the maximum data packet sending frequency, the data packet size, and the standard transmission duration corresponding to each size of data packet, obtain the maximum data packet sending frequency of the target network by screening the basic network performance parameter model corresponding to the target network, and obtain the standard transmission duration corresponding to each data packet in the data packet set corresponding to the target network by screening the data packet size of each data packet; By calculating the formula , calculate the first abnormal coefficient of each data packet in the data packet set ,in , They are respectively represented as the packet sending frequency and the maximum packet sending frequency of the target network in the corresponding unit time. , They are respectively represented as the actual transmission time and standard transmission time corresponding to each data packet in the data packet set corresponding to the target network. , They are respectively represented by the preset data packet sending frequency and the sending abnormal conversion factor and the first impact coefficient of data packet transmission, Represents the number of each data packet in the data packet set.

4. A network data interaction method according to claim 3, characterized in that: The specific implementation method of the network environment monitoring step is as follows: The network environment of the target network is monitored through the preset network monitoring component to obtain the network quality information corresponding to the target network, where the network quality information includes the network traffic change curve over time, the network delay change curve over time, the network jitter change curve over time and the packet loss rate change curve over time.

5. A network data interaction method according to claim 4, characterized in that: The specific implementation method of the preliminary analysis step is as follows: The network flow variation curve over time, the network delay variation curve over time, the network jitter variation curve over time and the packet loss rate variation curve over time are intercepted by using the initial transmission time and the termination transmission time corresponding to each data packet in the data packet set, so as to obtain the network flow curve segment, the network delay curve segment, the network jitter curve segment and the packet loss rate curve segment corresponding to each data packet in the data packet set; Extract the network traffic curve segment corresponding to each data packet in the data packet set to obtain the network traffic peak value corresponding to the transmission time of each data packet in the data packet set , Network traffic average and network traffic peaks ; Extract the network delay curve segment corresponding to each data packet in the data packet set to obtain the network delay peak value corresponding to the transmission time of each data packet in the data packet set , Average network delay and network latency spikes ; Extract the network jitter curve segment corresponding to each data packet in the data packet set to obtain the corresponding network jitter peak value during the transmission time of each data packet in the data packet set , Network jitter average and network jitter peak ; Extract the packet loss rate curve segment corresponding to each data packet in the data packet set to obtain the packet loss rate peak value corresponding to the transmission time of each data packet in the data packet set , Average packet loss rate and peak packet loss rate ; By calculating the formula , calculate the network traffic anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the network delay anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the network jitter anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the packet loss rate anomaly coefficient corresponding to each data packet in the data packet set ; By calculating the formula , calculate the second anomaly coefficient of each data packet in the data packet set ,in , , , They are respectively expressed as network traffic weight factor, network delay weight factor, network jitter weight factor and packet loss rate weight factor. , , , They are respectively represented by the preset network traffic anomaly coefficient influencing factor, network delay anomaly coefficient influencing factor, network jitter anomaly coefficient influencing factor and packet loss rate anomaly coefficient influencing factor, It is represented by the preset second abnormal coefficient influencing factor of the data packet.

6. A network data interaction method according to claim 5, characterized in that: The specific implementation method of the comprehensive analysis step is as follows: Establishing a data extraction relationship between the comprehensive analysis step and the database, extracting each threat content corresponding to each threat level and the threat coefficient corresponding to each threat level stored in the database; Parsing each data packet in the data packet set by a preset data packet parsing method to obtain a sub-content set corresponding to each data packet in the data packet set; Compare and match each sub-content in the sub-content set corresponding to each data packet with each threat content corresponding to each threat level, and obtain a threat identification set and an unknown identification set of the sub-content set corresponding to each data packet, wherein the threat identification set refers to the sub-content in the sub-content set that can be matched with each threat content corresponding to each threat level, and the unknown identification set refers to the sub-content in the sub-content set corresponding to each data packet that cannot be identified and matched with each threat content corresponding to each threat level; By calculating the formula , calculate and obtain the third abnormal coefficient of each data packet in the data packet set ,in It is expressed as the number of sub-contents corresponding to each preset threat level. It is expressed as the threat coefficient corresponding to each threat level, It is represented by the preset third abnormal coefficient influencing factor of the data packet, It is represented by the number of each threat level. the number of species expressed as threat level; By calculating the formula , calculate and obtain the comprehensive anomaly coefficient of each data packet in the data packet set ,in It is expressed as a preset data packet comprehensive anomaly coefficient influencing factor; The comprehensive data packet anomaly coefficient corresponding to each data packet in the data packet set is compared and analyzed with the preset comprehensive data packet anomaly coefficient threshold. If the comprehensive data packet anomaly coefficient corresponding to each data packet is less than or equal to the preset comprehensive data packet anomaly coefficient threshold, it means that each data packet is safe and normal, and the safety and normality of each data packet is recorded as the data packet security assessment result corresponding to the target network. If the comprehensive data packet anomaly coefficient corresponding to a data packet is greater than the preset comprehensive data packet anomaly coefficient threshold, it means that the data packet is unsafe, and the unsafe data packets corresponding to the data packet set are obtained by statistics, and the unsafe data packets corresponding to the data packet set are recorded as the data packet security assessment result corresponding to the target network.

7. A security gateway, applied to a network data interaction method according to any one of claims 1 to 6, characterized in that: include: Capture data packets of network transmission data to obtain a data packet set corresponding to the target network and data information corresponding to the data packet set; Performing a preliminary analysis on the data information corresponding to the data packet set to obtain a first data packet anomaly coefficient corresponding to each data packet in the data packet set; Monitor the network environment status corresponding to the target network and obtain the network quality information corresponding to the target network; According to the data information corresponding to the data packet set and the network quality information corresponding to the target network, a combined analysis is performed to obtain a second abnormal coefficient of the data packet corresponding to each data packet in the data packet set; The data packets corresponding to each data packet are parsed and content identified, and a comprehensive analysis is performed based on the first anomaly coefficient and the second anomaly coefficient of each data packet in the data packet set to obtain the data packet security assessment result corresponding to the target network.

Images