Network traffic data processing method, computer device and storage medium

Abstract

The invention discloses a network traffic data processing method, a computer device and a storage medium. The processing method comprises the following steps: obtaining to-be-processed network traffic data; determining data attribute information of the network flow data, and determining the category of the network flow data according to the data attribute information; determining a target processing strategy matched with the category from a plurality of processing strategies in a target database; and processing the network traffic data according to the target processing strategy to obtain target network traffic data. Therefore, different processing strategies are applied to different types of traffic, corresponding protection can be provided according to the sensitivity and risk level of the data, the fine-grained encryption mode is more targeted than traditional global encryption, and sensitive data can be more effectively protected while strategy management flexibility is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method for processing network traffic data, a computer device, and a storage medium. Background Art

[0002] As the demand for network security continues to increase, IPsec (Internet Protocol Security) is widely used as a network security protocol to provide secure IP communications.

[0003] Currently, IPsec implementations are usually based on fixed,security policies that rely solely on static traffic selection conditions (such as source IP, destination IP, protocol type, etc.), resulting in all traffic being processed in the same way. This coarse-grained control approach cannot cope with complex network environments and application scenarios, which may result in unnecessary performance overhead or fail to meet specific security requirements. Summary of the invention

[0004] The embodiments of the present application provide a method, a computer device and a storage medium for processing network traffic data, which apply different processing strategies to different types of traffic to perform security management more accurately.

[0005] In a first aspect, a method for processing network traffic data is provided, comprising: obtaining network traffic data to be processed; determining data attribute information of the network traffic data, and determining a category of the network traffic data according to the data attribute information, wherein the data attribute information includes at least two of an IP address, a port number, an application type, a user identity, and a time period; determining a target processing strategy matching the category from a plurality of processing strategies in a target database, each of the processing strategies being based on an Internet security protocol, and the processing strategy including whether to perform cryptographic operation processing and a cryptographic operation strategy to be adopted when performing cryptographic operation processing; processing the network traffic data according to the target processing strategy to obtain target network traffic data.

[0006] In a second aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method for processing network traffic data as described in the first aspect.

[0007] According to a third aspect, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method for processing network traffic data as described in the first aspect are implemented.

[0008] In a fourth aspect, a computer program product is provided, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method for processing network traffic data as described in the first aspect.

[0009] By applying the above technical solutions, the network traffic data to be processed is obtained; the data attribute information of the network traffic data is determined, and the category of the network traffic data is determined according to the data attribute information; the target processing strategy matching the category is determined from multiple processing strategies in the target database; the network traffic data is processed according to the target processing strategy to obtain the target network traffic data. In this way, different processing strategies can be applied to different types of traffic, so that corresponding protection can be provided according to the sensitivity and risk level of the data. This fine-grained encryption method is more targeted than traditional global encryption, and can more effectively protect sensitive data while increasing the flexibility of policy management. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0011] Figure 1 The process of the method for processing network traffic data of the embodiment of the present application is as follows Figure 1 ;

[0012] Figure 2 The process of the method for processing network traffic data of the embodiment of the present application is as follows Figure 2 ;

[0013] Figure 3 The process of the method for processing network traffic data of the embodiment of the present application is as follows Figure 3 ;

[0014] Figure 4 The process of the method for processing network traffic data of the embodiment of the present application is as follows Figure 4 ;

[0015] Figure 5 The process of the method for processing network traffic data of the embodiment of the present application is as follows Figure 5 ;

[0016] Figure 6 A schematic diagram of a network traffic data processing system according to an embodiment of the present application;

[0017] Figure 7 4 is a structural block diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0019] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0020] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0021] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0022] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0023] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0024] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0025] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0026] A method for processing network traffic data in an embodiment of the present application includes obtaining network traffic data to be processed; determining data attribute information of the network traffic data, and determining the category of the network traffic data according to the data attribute information; determining a target processing strategy that matches the category from multiple processing strategies in a target database; and processing the network traffic data according to the target processing strategy to obtain target network traffic data. In this way, different processing strategies can be applied to different types of traffic, so that corresponding protection can be provided according to the sensitivity and risk level of the data. This fine-grained encryption method is more targeted than traditional global encryption, and can more effectively protect sensitive data while increasing the flexibility of policy management.

[0027] like Figure 1 As shown, the method for processing network traffic data includes the following steps:

[0028] Step S101, obtaining network traffic data to be processed.

[0029] In this embodiment, the network traffic data to be processed may be obtained according to the user's access request, or may be traffic data sent by other servers or applications. Specifically, the network traffic data may be obtained by deploying traffic monitoring tools, such as network probes, IDS (Intrusion Detection System) / IPS (Intrusion Prevention System), etc.

[0030] In some embodiments of the present application, after obtaining the network traffic data to be processed, it also includes: preprocessing the network traffic data to ensure the accuracy of the network traffic data, and the preprocessing may include one or more of removing outliers, filling missing values ​​and normalization.

[0031] Step S102, determine the data attribute information of the network traffic data, and determine the category of the network traffic data according to the data attribute information, wherein the data attribute information includes at least two of the IP address, port number, application type, user identity, and time period.

[0032] In this embodiment, the network flow data carries data attribute information, and the data attribute information includes at least two of the IP address, port number, application type, user identity, and time period. Multiple types of network flow data are preset, and different types correspond to different data attribute data. The category of the network flow data is determined according to the data attribute information.

[0033] For example, the time period can be the time period for obtaining network traffic data, and the data attribute information can be determined based on the user identity and time period of the network traffic data. Different user identities can only access the network traffic data in the time period corresponding to themselves. When the user identity and time period are different, the category of the network traffic data is different. Alternatively, the data attribute information can also be determined based on the application type, port number, and time period. Different types of applications can only use the port number and time period corresponding to themselves to transmit network traffic data. When the application type, port number, and time period are different, the category of the network traffic data is different.

[0034] Step S103, determining a target processing strategy matching the category from a plurality of processing strategies in the target database, each of the processing strategies being based on an Internet security protocol, and the processing strategy including whether to perform cryptographic operation processing and the cryptographic operation strategy to be adopted when performing cryptographic operation processing.

[0035] In this embodiment, the target database stores multiple processing strategies based on the Internet security protocol IPsec, each processing strategy includes whether to perform cryptographic operation processing, and the cryptographic operation strategy adopted when performing cryptographic operation processing. The cryptographic operation strategy is implemented based on the corresponding encryption algorithm (such as AES, 3DES, etc.), which can characterize the encryption strength. For example, if the first processing strategy and the second processing strategy are to perform cryptographic operation, the first processing strategy adopts the first cryptographic operation strategy, and the second processing strategy adopts the second cryptographic operation strategy, the encryption strength of the first cryptographic operation strategy and the second cryptographic operation strategy are different.

[0036] There is a corresponding relationship between each processing strategy and the type of each network traffic data. After determining the type of network traffic data, the target database is queried according to the type, and the processing strategy matching the type is determined as the target processing strategy. It can be understood that the target processing strategy also includes whether to perform cryptographic operation processing and the cryptographic operation strategy adopted when performing cryptographic operation processing.

[0037] Step S104: Process the network traffic data according to the target processing strategy to obtain target network traffic data.

[0038] In this embodiment, the network traffic data is processed according to the target processing strategy so that the network traffic data meets the security requirements corresponding to the target processing strategy, and the target network traffic data is obtained, and the target network traffic data can be subsequently processed or forwarded.

[0039] In some embodiments of the present application, network traffic data may be processed at the network layer or the application layer according to a target processing strategy, so as to implement the processing of network traffic data at a firewall or a router.

[0040] In some embodiments of the present application, the network traffic data is plain text, and the target network traffic data is cipher text.

[0041] The method for processing network traffic data of the embodiment of the present application obtains the network traffic data to be processed; determines the data attribute information of the network traffic data, and determines the category of the network traffic data according to the data attribute information, wherein the data attribute information includes at least two of the IP address, port number, application type, user identity, and time period; determines the target processing strategy that matches the category from multiple processing strategies in the target database, wherein each processing strategy is based on the Internet security protocol, and the processing strategy includes whether to perform cryptographic operation processing and the cryptographic operation strategy adopted when performing cryptographic operation processing; processes the network traffic data according to the target processing strategy to obtain the target network traffic data. In this way, different processing strategies are applied to different types of traffic, so that corresponding protection can be provided according to the sensitivity and risk level of the data. This fine-grained encryption method is more targeted than traditional global encryption, and can more effectively protect sensitive data while increasing the flexibility of policy management.

[0042] In some embodiments of the present application, the network traffic data is processed according to the target processing strategy to obtain target network traffic data, such as Figure 2 As shown, the following steps are included:

[0043] Step S1041, when the target processing strategy is to perform cryptographic operation processing, the network traffic data is cryptographically processed using the cryptographic operation strategy in the target processing strategy to obtain the target network traffic data, and the cryptographic operation processing includes encryption processing or authentication processing.

[0044] In this embodiment, the cryptographic operation processing includes encryption processing or authentication processing. If the target processing strategy is to perform cryptographic operation processing, the cryptographic operation strategy in the target processing strategy is determined, and the network traffic data is encrypted or authenticated using the cryptographic operation strategy to obtain the target network traffic data. For example, if it is necessary to determine that encryption processing is required according to the type of network traffic data, and a stronger encryption strength is required, the cryptographic operation strategy in the target processing strategy has a stronger encryption strength to ensure security. If it is necessary to determine that encryption processing is required according to the type of network traffic data, and a lower encryption strength is required, the cryptographic operation strategy in the target processing strategy has a lower encryption strength, which can improve encryption efficiency. If it is necessary to determine that authentication processing is required according to the type of network traffic data, and a lower encryption strength is required, the cryptographic operation strategy in the target processing strategy has a lower encryption strength (such as using an authentication method with a simple algorithm or a single authentication method, etc.), which can improve authentication efficiency.

[0045] Step S1042, when the target processing strategy is not to perform cryptographic operation processing, determine the network traffic data as the target network traffic data.

[0046] In this embodiment, if the target processing strategy is not to perform cryptographic operation processing, it means that there is no need to process the network traffic data, and the network traffic data is directly determined as the target network traffic data.

[0047] By performing cryptographic operations according to the corresponding cryptographic operation strategy when the target processing strategy is to perform cryptographic operations, and not processing the network traffic data when the target processing strategy is not to perform cryptographic operations, it is possible to accurately adjust the processing strategy according to the type of network traffic data, reasonably use system resources, ensure that there is no excessive impact on network performance, and improve the flexibility and accuracy of security management.

[0048] In some embodiments of the present application, after obtaining the target network traffic data, such as Figure 3 As shown, the following steps are also included:

[0049] Step S105, obtaining network environment data, wherein the network environment data includes at least one of network traffic, network status and security events.

[0050] In this embodiment, the network environment data includes at least one of network traffic, network status and security events. The network traffic may be the size and type of network traffic, the network status may be the network bandwidth, latency, throughput, packet loss rate, round-trip time (RTT), channel utilization, etc., and security events may include DoS attacks, DDoS attacks, phishing attacks, password attacks, SQL injection attacks, DNS spoofing, brute force cracking and other events.

[0051] Step S106: evaluate the network environment data using target evaluation rules to determine environment attribute information of the network environment data, where the environment attribute information includes at least one of a security threat level and a network load.

[0052] In this embodiment, the target evaluation rules can be rules in the threat intelligence platform or customized evaluation rules. The target evaluation rules are used to evaluate the network environment data to determine the environmental attribute information of the network environment data. The environmental attribute information can be the security threat level, the network load, or the security threat level and the network load.

[0053] Step S107: when the environment attribute information does not match the target processing policy, update the target processing policy according to the environment attribute information.

[0054] In this embodiment, it is determined whether the environmental attribute information matches the target processing policy. If they do not match, the target processing policy is updated according to the environmental attribute information. For example, if the security threat level increases, resulting in the current target processing policy being unable to meet the security requirements corresponding to the security threat level, it is determined that the environmental attribute information does not match the target processing policy, and the cryptographic operation policy in the target processing policy can be replaced with a cryptographic operation policy with a higher encryption strength to update the target processing policy. Alternatively, if the network load increases and the security threat level decreases, and the current target processing policy uses a cryptographic operation policy with a higher encryption strength, which will cause the network load to further increase, it is determined that the environmental attribute information does not match the target processing policy, and the cryptographic operation policy in the target processing policy can be replaced with a cryptographic operation policy with a lower encryption strength to update the target processing policy and reduce the network load.

[0055] Step S108, processing the new network traffic data according to the updated target processing strategy.

[0056] According to the updated target processing strategy, the new network traffic data is encrypted or authenticated, or the new network traffic data is not processed, so that the processed new network traffic data meets the security requirements matching the updated target processing strategy.

[0057] When the environmental attribute information does not match the target processing strategy, the target processing strategy is updated through the environmental attribute information of the network environment data, which realizes automatic and dynamic adjustment of the target processing strategy according to different network environments, avoids unnecessary encryption overhead or potential security risks, and improves security management efficiency.

[0058] In some embodiments of the present application, updating the target processing strategy according to the environmental attribute information includes one of the following:

[0059] updating the cryptographic operation strategy in the target processing strategy according to the environmental attribute information to change the encryption strength corresponding to the cryptographic operation strategy;

[0060] updating the target processing strategy from not performing cryptographic operation processing to performing cryptographic operation processing according to the environmental attribute information, and determining the cryptographic operation strategy in the updated target processing strategy;

[0061] The target processing strategy is updated from performing cryptographic operation processing to not performing cryptographic operation processing according to the environmental attribute information.

[0062] In this embodiment, the cryptographic operation strategy can be updated in a variety of ways according to different situations. The cryptographic operation strategy in the target processing strategy can be updated according to the environmental attribute information to change the encryption strength corresponding to the cryptographic operation strategy. For example, if the security threat level increases, the encryption strength corresponding to the cryptographic operation strategy is increased, and if the security threat level decreases, the encryption strength corresponding to the cryptographic operation strategy is decreased, so as to reduce unnecessary cryptographic operation overhead and improve data processing efficiency.

[0063] The target processing policy can also be updated from not performing cryptographic operations to performing cryptographic operations based on environmental attribute information, and the cryptographic operation policy in the updated target processing policy can be determined. For example, if the current target processing policy is not to perform cryptographic security operations, after the security threat level increases, the target processing policy is updated from not performing cryptographic operations to performing cryptographic operations, and the cryptographic operation policy corresponding to the current security threat level can be determined to meet the security requirements under the current security threat level.

[0064] The target processing strategy can also be updated from performing cryptographic operations to not performing cryptographic operations based on environmental attribute information. For example, if the current target processing strategy is to perform cryptographic security operations, after the network load increases and the security threat level decreases, the target processing strategy will be updated to not perform cryptographic operations, so as to reduce unnecessary cryptographic operation overhead, reduce network load, and improve the processing efficiency of other tasks.

[0065] In some embodiments of the present application, after obtaining the target network traffic data, such as Figure 4 As shown, the following steps are also included:

[0066] Step S109: responding to an update instruction issued by the user, updating the target processing strategy according to the update instruction.

[0067] In this embodiment, in addition to automatically updating the target processing policy based on environmental attribute information, an update instruction for the target update policy issued by the user can also be obtained from the human-computer interaction interface or the user terminal, and the target processing policy can be updated according to the update instruction. For example, the cryptographic operation policy in the target processing policy can be updated according to the update instruction to change the encryption strength corresponding to the cryptographic operation policy; the target processing policy can also be updated from not performing cryptographic operation processing to performing cryptographic operation processing according to the update instruction, and the cryptographic operation policy in the updated target processing policy can be determined; the target processing policy can also be updated from performing cryptographic operation processing to not performing cryptographic operation processing according to the update instruction.

[0068] Step S110, processing new network traffic data according to the updated target processing strategy.

[0069] The new network traffic data is processed according to the updated target processing strategy so that the processed new network traffic data meets the security requirements of the updated target processing strategy.

[0070] By updating the target processing strategy according to the update instruction, the processing strategy can be updated according to the user's needs, thereby improving the user experience.

[0071] In some embodiments of the present application, Figure 5 As shown, the following steps are also included:

[0072] Step S111, in response to receiving a configuration instruction for the target database, performing a configuration operation on the target database, the configuration operation including at least one of adding a processing strategy, deleting a processing strategy, updating a processing strategy, updating a data category associated with a processing strategy, and updating a priority of a processing strategy.

[0073] In this embodiment, a graphical user interface (GUI) and a command line interface (CLI) may be provided to allow an administrator to define and configure policies. The configuration instructions for the target database may be issued by a user. After receiving the configuration instructions, at least one of adding a processing policy, deleting a processing policy, updating a processing policy, updating a data category associated with a processing policy, and updating a priority of a processing policy is performed according to the configuration instructions. When performing configuration operations, the user may perform configuration operations based on at least two of an IP address, a port number, an application type, a user identity, and a time period.

[0074] Step S112: sending the change data corresponding to the configuration operation in the target database to the target peer device.

[0075] In this embodiment, after the configuration operation is completed, the changed data corresponding to the configuration operation in the target database is sent to the target peer device, thereby ensuring that the target peer device can correctly decrypt the received network traffic data.

[0076] By configuring the target database through configuration instructions, users can configure the processing strategies in the target database as needed, which improves the user experience. By sending the change data corresponding to the configuration operation in the target database to the target peer device, it is ensured that the target peer device can correctly decrypt the received network traffic data, thereby improving the reliability of security management.

[0077] In some embodiments of the present application, it also includes: in response to receiving a query instruction for the target database, querying the processing instructions in the target database according to the query instruction, and returning the query results, thereby satisfying the user's query requirements for the processing strategy and improving the user experience.

[0078] In some embodiments of the present application, determining the category of the network traffic data according to the data attribute information includes:

[0079] The network traffic data is classified using deep packet inspection technology or a machine learning algorithm to determine the category.

[0080] After this embodiment, the network traffic data can be classified using deep packet inspection technology or machine learning algorithms, thereby efficiently determining the category of the network traffic data.

[0081] The present application also proposes a method for processing network traffic data, such as Figure 6 As shown, the processing method is applied to a system including a policy management module, a dynamic analysis module, an encryption control module and a policy update module, and includes:

[0082] Using the dynamic analysis module to obtain the network traffic data to be processed;

[0083] Determine data attribute information of the network traffic data by using a dynamic analysis module, determine a category of the network traffic data according to the data attribute information, and provide the category to an encryption control module, wherein the data attribute information includes at least two of an IP address, a port number, an application type, a user identity, and a time period;

[0084] Determine, by means of the encryption control module, a target processing strategy matching the category from a plurality of processing strategies in a target database of the strategy management module, each of the processing strategies being based on an Internet security protocol, and the processing strategy including whether to perform cryptographic operation processing and a cryptographic operation strategy to be adopted when performing cryptographic operation processing;

[0085] The network flow data is processed according to the target processing strategy using an encryption control module to obtain target network flow data.

[0086] In some embodiments of the present application, the encryption control module is used to process the network traffic data according to the target processing strategy to obtain the target network traffic data, including:

[0087] In the case where the target processing strategy is to perform cryptographic operation processing, using an encryption control module, based on the cryptographic operation strategy in the target processing strategy, the network traffic data is subjected to cryptographic operation processing to obtain the target network traffic data, wherein the cryptographic operation processing includes encryption processing or authentication processing;

[0088] When the target processing strategy is not to perform cryptographic operation processing, the network traffic data is determined as the target network traffic data by using an encryption control module.

[0089] In some embodiments of the present application, after obtaining the target network traffic data, the method further includes:

[0090] Using a dynamic analysis module to obtain network environment data, the network environment data includes at least one of network traffic, network status, and security events;

[0091] Using a dynamic analysis module to evaluate the network environment data according to a target evaluation rule, determine environmental attribute information of the network environment data and output it to a policy update module, wherein the environmental attribute information includes at least one of a security threat level and a network load;

[0092] In the case where the environmental attribute information does not match the target processing strategy, using a strategy update module, updating the target processing strategy according to the environmental attribute information and pushing it to a strategy management module;

[0093] The encryption control module is used to obtain the updated target processing strategy from the policy management module, and the new network traffic data is processed according to the updated target processing strategy.

[0094] In some embodiments of the present application, using a policy update module to update the target processing policy according to the environmental attribute information and push it to the policy management module includes one of the following:

[0095] Using a policy update module, the cryptographic operation policy in the target processing policy is updated according to the environmental attribute information to change the encryption strength corresponding to the cryptographic operation policy;

[0096] Using a policy update module, the target processing policy is updated from not performing cryptographic operation processing to performing cryptographic operation processing according to the environmental attribute information, and a cryptographic operation policy in the updated target processing policy is determined;

[0097] The target processing policy is updated from performing cryptographic operation processing to not performing cryptographic operation processing according to the environmental attribute information by using a policy update module.

[0098] In some embodiments of the present application, after obtaining the target network traffic data, the method further includes:

[0099] In response to an update instruction issued by a user, using a policy update module to update the target processing policy according to the update instruction and output it to the encryption control module;

[0100] The encryption control module is used to process new network traffic data according to the updated target processing strategy.

[0101] In some embodiments of the present application, after obtaining the target network traffic data, it also includes: using the policy update module to collect feedback from the encryption control module and the dynamic analysis module, evaluating the policy effect, and generating optimization suggestions, and using the log management tool to perform data analysis.

[0102] In some embodiments of the present application, it also includes:

[0103] In response to receiving a configuration instruction for the target database, using a policy management module, performing a configuration operation on the target database, the configuration operation including at least one of adding a processing policy, deleting a processing policy, updating a processing policy, updating a data category associated with a processing policy, and updating a priority of a processing policy;

[0104] The policy management module is used to send the change data corresponding to the configuration operation in the target database to the target peer device.

[0105] In some embodiments of the present application, determining the category of the network traffic data according to the data attribute information includes:

[0106] The network traffic data is classified by using a dynamic analysis module based on deep packet inspection technology or a machine learning algorithm to determine the category.

[0107] In order to further explain the technical idea of ​​the present application, the technical solution of the present application is now described in combination with specific application scenarios.

[0108] Scenario 1: The enterprise allows employees to remotely access the company's internal network through VPN, which involves the transmission of sensitive business data. The detailed application is as follows:

[0109] Policy configuration: Enterprises define fine-grained encryption policies to adjust encryption levels based on employee access rights and data sensitivity. For example, financial department employees need a higher encryption level for data transmission when accessing remotely.

[0110] Traffic monitoring: The dynamic analysis module monitors remote office traffic in real time and analyzes whether there are any abnormal activities, such as unauthorized access attempts or data leaks.

[0111] Dynamic encryption: If the dynamic analysis module detects abnormal traffic or unauthorized access behavior, the encryption control module will automatically increase the encryption strength of the relevant traffic to protect data security.

[0112] Policy Adjustment: The policy update module regularly optimizes encryption policies based on real-time analysis data and changes in the remote office environment, and pushes updates to the policy management module to ensure that all policies are centrally managed.

[0113] Scenario 2: An organization handles highly confidential communication data and internal documents and needs to prevent information leakage and unauthorized access. The detailed application is as follows:

[0114] Encryption policy: Set fine-grained encryption policies for different types of files and communications. For example, confidential files use the strongest encryption algorithm, while general internal communications use medium-strength encryption.

[0115] Security monitoring: The dynamic analysis module monitors internal network traffic and analyzes whether there is any suspicious access behavior or data leakage risk. If any abnormality is found, the encryption control module is notified immediately.

[0116] Encryption adjustment: The encryption control module automatically adjusts the encryption strategy based on the monitoring results to strengthen the protection of confidential communications.

[0117] Policy Update: The Policy Update module combines analytical data and security events to regularly adjust encryption policies to ensure continuous protection and compliance.

[0118] By applying the above technical solution, the following technical effects are achieved:

[0119] 1. Enhanced data security

[0120] By applying different levels of encryption to different types of traffic, the system can provide corresponding protection based on the sensitivity and risk level of the data. This fine-grained encryption method is more targeted than traditional global encryption and can more effectively protect sensitive data.

[0121] 2. Real-time threat detection and response

[0122] Real-time monitoring and analysis of network traffic can quickly identify abnormal behavior or potential security threats. For example, abnormal traffic patterns or suspicious access attempts will be detected in a timely manner and trigger appropriate security responses.

[0123] 3. Improve network performance and efficiency

[0124] Different encryption strengths are applied according to the type and requirements of traffic. When the local configuration algorithm changes, the policy management module synchronizes with the peer device in real time. The system can optimize network performance while ensuring security. For example, lighter encryption is used for insensitive data, and the policy is synchronized to the peer device to reduce the consumption of system resources.

[0125] 4. Flexible strategy management

[0126] Supports different security policies for different types of traffic, enhancing the flexibility of policy management. Policies can be customized based on department, user role or data type, thus improving the accuracy of security management.

[0127] An embodiment of the present application also proposes a network traffic data processing device, including: a first obtaining unit, used to obtain the network traffic data to be processed; a first determining unit, used to determine data attribute information of the network traffic data, and determine the category of the network traffic data according to the data attribute information, wherein the data attribute information includes at least two of an IP address, a port number, an application type, a user identity, and a time period; a second determining unit, used to determine a target processing strategy matching the category from a plurality of processing strategies in a target database, each of the processing strategies being based on an Internet security protocol, and the processing strategy including whether to perform cryptographic operations and a cryptographic operation strategy to be adopted when performing cryptographic operations; the second obtaining unit, used to process the network traffic data according to the target processing strategy to obtain target network traffic data.

[0128] The network traffic data processing device of the embodiment of the present application obtains the network traffic data to be processed through the first obtaining unit; determines the data attribute information of the network traffic data through the first determining unit, and determines the category of the network traffic data according to the data attribute information; determines the target processing strategy that matches the category from multiple processing strategies in the target database through the second determining unit; and processes the network traffic data according to the target processing strategy through the second obtaining unit to obtain the target network traffic data. In this way, different processing strategies can be applied to different types of traffic, so that corresponding protection can be provided according to the sensitivity and risk level of the data. This fine-grained encryption method is more targeted than traditional global encryption, and can more effectively protect sensitive data while increasing the flexibility of policy management.

[0129] In a specific application scenario, the second acquisition unit is specifically used to: when the target processing strategy is to perform cryptographic operation processing, use the cryptographic operation strategy in the target processing strategy to perform cryptographic operation processing on the network traffic data to obtain the target network traffic data, and the cryptographic operation processing includes encryption processing or authentication processing; when the target processing strategy is not to perform cryptographic operation processing, determine the network traffic data as the target network traffic data.

[0130] In a specific application scenario, it also includes an update unit, which is used to: obtain network environment data, the network environment data including at least one of network traffic, network status and security events; evaluate the network environment data using target evaluation rules to determine environmental attribute information of the network environment data, the environmental attribute information including at least one of security threat level and network load; if the environmental attribute information does not match the target processing strategy, update the target processing strategy according to the environmental attribute information; and process new network traffic data according to the updated target processing strategy.

[0131] In a specific application scenario, the update unit is specifically used to perform one of the following: updating the cryptographic operation strategy in the target processing strategy according to the environmental attribute information to change the encryption strength corresponding to the cryptographic operation strategy; updating the target processing strategy from not performing cryptographic operation processing to performing cryptographic operation processing according to the environmental attribute information, and determining the cryptographic operation strategy in the updated target processing strategy; updating the target processing strategy from performing cryptographic operation processing to not performing cryptographic operation processing according to the environmental attribute information.

[0132] In a specific application scenario, the update unit is further used to: respond to an update instruction issued by a user, update the target processing strategy according to the update instruction; and process new network traffic data according to the updated target processing strategy.

[0133] In a specific application scenario, it also includes a configuration unit, which is used to: in response to receiving a configuration instruction for the target database, perform a configuration operation on the target database, the configuration operation including adding a processing strategy, deleting a processing strategy, updating a processing strategy, updating a data category associated with a processing strategy, and updating a priority of a processing strategy; and send the changed data in the target database corresponding to the configuration operation to the target peer device.

[0134] In a specific application scenario, the first determination unit is specifically used to: classify the network traffic data using deep packet inspection technology or a machine learning algorithm to determine the category.

[0135] The present application also provides a computer device, such as Figure 7 As shown, it includes a processor and a memory, the memory stores an executable program, and the processor executes the steps of the network traffic data processing method described in each embodiment of the present application.

[0136] The computer device in the embodiment of the present application may be a terminal, or may be other devices other than a terminal. Exemplarily, the computer device may be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile Internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc. It may also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present disclosure.

[0137] The memory may include a RAM (Random Access Memory) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0138] The above-mentioned processor can be a general-purpose processor, including CPU, NP (Network Processor), etc.; it can also be DSP (Digital Signal Processing), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0139] In another embodiment provided in the present application, a computer-readable storage medium is also provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method for processing network traffic data described in each embodiment of the present application are implemented.

[0140] In another embodiment provided by the present application, a computer program product is also provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the method for processing network traffic data described in each embodiment of the present application.

[0141] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0142] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A method for processing network traffic data, characterized in that: include: Obtaining network traffic data to be processed; Determine data attribute information of the network traffic data, and determine the category of the network traffic data according to the data attribute information, wherein the data attribute information includes at least two of an IP address, a port number, an application type, a user identity, and a time period; Determine a target processing strategy matching the category from a plurality of processing strategies in the target database, each of the processing strategies being based on an Internet security protocol, the processing strategy including whether to perform cryptographic operation processing and a cryptographic operation strategy to be adopted when performing cryptographic operation processing; The network flow data is processed according to the target processing strategy to obtain target network flow data.

2. The method for processing network traffic data according to claim 1, characterized in that: Processing the network flow data according to the target processing strategy to obtain target network flow data includes: In the case where the target processing strategy is to perform cryptographic operation processing, performing cryptographic operation processing on the network traffic data using the cryptographic operation strategy in the target processing strategy to obtain the target network traffic data, wherein the cryptographic operation processing includes encryption processing or authentication processing; When the target processing strategy is not to perform cryptographic operation processing, the network traffic data is determined as the target network traffic data.

3. The method for processing network traffic data according to claim 1, characterized in that: After obtaining the target network traffic data, the method further includes: Obtaining network environment data, wherein the network environment data includes at least one of network traffic, network status, and security events; Evaluate the network environment data using a target evaluation rule to determine environment attribute information of the network environment data, wherein the environment attribute information includes at least one of a security threat level and a network load; In the case where the environmental attribute information does not match the target processing strategy, updating the target processing strategy according to the environmental attribute information; The new network traffic data is processed according to the updated target processing strategy.

4. The method for processing network traffic data according to claim 3, characterized in that: Updating the target processing strategy according to the environmental attribute information includes one of the following: updating the cryptographic operation strategy in the target processing strategy according to the environmental attribute information to change the encryption strength corresponding to the cryptographic operation strategy; updating the target processing strategy from not performing cryptographic operation processing to performing cryptographic operation processing according to the environmental attribute information, and determining the cryptographic operation strategy in the updated target processing strategy; The target processing strategy is updated from performing cryptographic operation processing to not performing cryptographic operation processing according to the environmental attribute information.

5. The method for processing network traffic data according to claim 1, characterized in that: After obtaining the target network traffic data, the method further includes: In response to an update instruction issued by a user, updating the target processing strategy according to the update instruction; The new network traffic data is processed according to the updated target processing strategy.

6. The method for processing network traffic data according to claim 1, characterized in that: Also includes: In response to receiving a configuration instruction for the target database, performing a configuration operation on the target database, the configuration operation comprising at least one of adding a processing strategy, deleting a processing strategy, updating a processing strategy, updating a data category associated with a processing strategy, and updating a priority of a processing strategy; The change data corresponding to the configuration operation in the target database is sent to the target peer device.

7. The method for processing network traffic data according to claim 1, characterized in that: Determining the category of the network traffic data according to the data attribute information includes: The network traffic data is classified using deep packet inspection technology or a machine learning algorithm to determine the category.

8. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method for processing network traffic data according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by a processor, the steps of the method for processing network traffic data as described in any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the method for processing network traffic data as described in any one of claims 1 to 7 are implemented.

Images