Network resource access control method for ship network system

Abstract

The present application relates to the technical field of network resource access, and specifically to a network resource access control method for a ship network system, the method comprising: determining the access change degree by analyzing the difference between the login time period of the authorized personnel at each login and the login IP respectively with the common IP address and the daily login time period; determining the similarity between any two logins of the authorized personnel; constructing the trust degree by analyzing the difference in the access logs after different logins of the authorized personnel, and the login habits of the authorized personnel, and determining the trust degree; constructing the network attack value by analyzing the security status of the network environment, and determining the trust degree correction value in combination with the trust degree, and controlling the access to the network resources. The present application aims to improve the security of network resource access in the ship network system.

Description

Technical Field

[0001] The present application relates to the technical field of network resource access, and in particular to a network resource access control method for a ship network system. Background Art

[0002] According to the network security requirements and security protection purposes of the ship network system, through the analysis of network structure and network security risks, coupled with the increasingly serious security threats such as hackers and viruses, it is imperative to solve the information security problems of the ship network system.

[0003] In the access control of network resources in ship network systems, detailed logging of user behavior is usually carried out, and it is relied on to monitor user behavior and detect abnormal activities. However, in complex systems, it may be very difficult to distinguish normal operations from potential malicious activities based solely on user log records. If abnormal behavior cannot be detected in time, potential security threats may not be responded to in time, thereby reducing the security of accessing network resources in the ship network system. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides a network resource access control method for a ship network system to solve the existing problems.

[0005] The network resource access control method for the ship network system of the present application adopts the following technical solutions:

[0006] An embodiment of the present application provides a network resource access control method for a ship network system, the method comprising the following steps:

[0007] During the process of accessing the network resources of the ship network system, obtain the number of times the authorized personnel have logged into the authorized account within the preset time before the current moment, the IP address and login time period of each login, and all the service ports accessed after each login and their respective access start time; obtain the upstream and downstream traffic, throughput and throughput limit value of the ship network system at the current moment;

[0008] The number of logins for each IP address and each login period before the current moment is counted respectively to obtain the commonly used IP addresses and daily login periods of the authorized personnel; based on the difference between the IP address at each login and the commonly used IP address, the IP judgment factor at each login of the authorized personnel is determined, and the access change degree of the authorized personnel at each login is determined in combination with the time interval between the login period at each login and the daily login period, the difference in the number of logins between the login period and the daily login period, and the frequency of use of the IP address used at each login;

[0009] Between any two logins of the authorized account by the authorized personnel, the difference in the number of all business ports accessed, the similarity of the accessed business ports, and the interval between the start time of accesses to the same business port are analyzed to determine the similarity between any two logins of the authorized personnel;

[0010] Based on the time interval between any two login periods and the approximation, the habituation of the authorized person is determined; based on the average distribution of access changes of all logins of the authorized person before the current moment, the extreme distribution of all the approximations, and the habituation, the trust of the authorized person at the current moment is determined;

[0011] Based on the difference between the upstream and downstream traffic at the current moment, and the difference between the throughput and the throughput limit value, the network attack value at the current moment is determined, and combined with the trust, the trust correction value of the authorized personnel at the current moment is determined to control access to network resources.

[0012] Preferably, the method for obtaining the commonly used IP address and daily login time period of the authorized personnel is:

[0013] Among all IP addresses of the authorized personnel, the IP address with the most login times is used as the authorized personnel's common IP address; among all login periods of the authorized personnel, the login period with the most login times is used as the authorized personnel's daily login period.

[0014] Preferably, the method for determining the IP judgment factor each time the authorized person logs in is:

[0015] If the IP address of the authorized person at each login is the same as the common IP address, the IP judgment factor of the authorized person at each login is set to 1; otherwise, the IP judgment factor of the authorized person at each login is set to 0.

[0016] Preferably, the expression of the access change degree of the authorized person each time he logs in is: ; In the formula, It represents the access change degree of the authorized person when logging in for the i-th time; It represents the time interval between the authorized person's login period for the i-th login and the daily login period; It represents the difference between the number of logins during the login period when the authorized person logged in for the i-th time before the current moment and the number of logins during the daily login period; Indicates the IP judgment factor when the authorized person logs in for the i-th time; It indicates the usage frequency of the IP address of the authorized person at the time of the i-th login within the preset time before the current time; exp() indicates an exponential function with a natural constant as the base; Indicates a preset constant greater than 0.

[0017] Preferably, the method for determining the similarity between any two logins of the authorized personnel is:

[0018] All business ports accessed by the authorized personnel after each login are sorted in ascending order according to the access start time, and the total number of the same business ports accessed between any two logins is recorded as the same port value between any two logins;

[0019] The number of service ports with the same access order between any two logins is recorded as the same-order access port value between any two logins;

[0020] The similarity between any two logins of an authorized person The expression is: ; In the formula, It indicates the difference in the number of all business ports accessed between any two logins of the authorized personnel; L indicates the ratio of the same port value to the port value accessed in the same order between any two logins of the authorized personnel; D indicates the same port value between any two logins of the authorized personnel; Indicates that the authorized personnel can access the The interval between the access start times of the same service port; Indicates a preset constant greater than 0.

[0021] Preferably, the method for determining the habitual degree of the authorized person is:

[0022] Calculate the time interval between any two login periods of the authorized person, record it as the login interval, take the mean of all login intervals as a normalized value, and take the ratio of the mean of the similarity between all logins of the authorized person to the normalized value as the habituation of the authorized person.

[0023] Preferably, the method for determining the trustworthiness of the authorized person at the current moment is:

[0024] Calculate the average value of the access change degree of all authorized personnel's logins before the current moment;

[0025] The maximum value of the approximations between all logins of the authorized person before the current moment is obtained, and the product of the maximum value and the habit degree is divided by the mean of the access change degree to be used as the trust degree of the authorized person at the current moment.

[0026] Preferably, the method for determining the network attack value at the current moment is:

[0027] Use traffic analysis tools to determine whether there is a malicious payload in the data packet transmitted by the ship network system at the current moment. If there is a malicious payload in the data packet, the malicious attack value at the current moment is set to 1, otherwise, the malicious attack value at the current moment is set to 0;

[0028] The current network attack value The expression is: ; In the formula, Indicates the ratio between upstream and downstream traffic at the current moment; Indicates the difference between the throughput at the current moment and the throughput limit value; represents the malicious attack value at the current moment; norm[ ] represents the normalization function.

[0029] Preferably, the expression of the trust correction value of the authorized person at the current moment is: ; In the formula, Indicates the trust correction value of the authorized person at the current moment; represents the trust level of the authorized person at the current moment; norm[ ] represents the normalization function.

[0030] Preferably, the control of access to network resources includes:

[0031] If the trust correction value of the authorized person at the current moment is greater than the preset threshold, the authorized person is allowed to access the network resources of the ship network system; otherwise, the authorized person is denied access to the network resources of the ship network system.

[0032] This application has at least the following beneficial effects:

[0033] This application constructs the access variation degree by analyzing the difference between the login time period and login IP of the authorized personnel at each login, the commonly used IP address and the daily login time period, and reflects the difference between the login behavior of the authorized personnel and the normal behavior pattern, thereby helping to identify abnormal login behavior, thereby controlling the access of the authorized personnel and reducing the risk of leakage of network resources; further, by analyzing the difference in access logs after different logins of the authorized personnel and the login habits of the authorized personnel, the trust degree is constructed, reflecting whether there is an abnormality in the access of the authorized personnel, which can be used as an important basis for controlling the access to network resources; further, by analyzing the security status of the network environment, a network attack value is constructed, and combined with the trust degree, a trust degree correction value is constructed. The trust degree correction value takes into account the impact of network attacks on the original trust degree, and can more accurately evaluate the access security of the authorized personnel in the current network environment, while ensuring that the authorized personnel can access network resources normally when the network environment is safe. This application improves the security of access to network resources in the ship network system by comprehensively considering the access habits of authorized personnel and the security status of the network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0035] Figure 1 A flowchart of a method for controlling network resource access to a ship network system provided by an embodiment of the present application;

[0036] Figure 2 A schematic diagram of a trust correction value extraction process provided for an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to further explain the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the network resource access control method for a ship network system proposed by the present application, its specific implementation method, structure, features and effects are described in detail below in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0038] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0039] The specific scheme of the network resource access control method for a ship network system provided by the present application is described in detail below with reference to the accompanying drawings.

[0040] An embodiment of the present application provides a network resource access control method for a ship network system. Specifically, the following network resource access control method for a ship network system is provided. Figure 1 , the method comprises the following steps:

[0041] Step S1: During the network resource access process of the ship network system, obtain the number of times the authorized personnel log in to the authorized account within the preset time period before the current moment, the IP address and login time period of each login, and all service ports accessed after each login and their respective access start time; obtain the upstream and downstream traffic, throughput and throughput limit value of the ship network system at the current moment.

[0042] During the process of accessing network resources of the ship network system, obtain the number of times the authorized personnel log in to the authorized account within the preset time before the current moment, the IP address and login time period of each login, and all business ports accessed after each login and their respective access start time; obtain the upstream and downstream traffic, throughput and throughput limit value of the ship network system at the current moment.

[0043] It should be noted that the value of the preset time length is manually set. In this embodiment, the value of the preset time length is 15 days. The implementer can also set it by himself according to the specific situation. This embodiment does not impose any special restrictions.

[0044] The login period refers to the time period from the time when the authorized person logs into the authorized account to the time when he / she logs off.

[0045] Step S2: Count the number of logins for each IP address and each login period before the current moment to obtain the commonly used IP addresses and daily login periods of the authorized personnel; determine the IP judgment factor for each login of the authorized personnel based on the difference between the IP address at each login and the commonly used IP address, and combine the time interval between the login period and the daily login period at each login, the difference in the number of logins between the login period and the daily login period, and the frequency of use of the IP address used at each login to determine the access change degree of the authorized personnel each time they log in.

[0046] The normal behavior pattern of authorized personnel usually has certain regularity, that is, under normal circumstances, the login time and login IP of authorized personnel are often the same. When the login time and login IP are significantly different from the daily login time and the IP used, it proves that the authorized account activity may be abnormal, indicating that the account password has been cracked or the authorized account has been misused. Therefore, in order to improve the data security of the ship network system, by analyzing the differences between different logins, it is possible to determine whether data leakage will occur during the authorized personnel's access to network resources, and then control the access of authorized personnel, specifically:

[0047] (1) First, analyze the authorized personnel’s common login time periods and login IP addresses based on their login habits. Specifically:

[0048] Among all IP addresses of the authorized personnel, the IP address with the most login times is used as the authorized personnel's common IP address; among all login periods of the authorized personnel, the login period with the most login times is used as the authorized personnel's daily login period.

[0049] (2) Furthermore, by comparing the IP address used by the authorized person each time he logs in with the commonly used IP address, we can preliminarily determine whether there are security risks in the authorized person's account login, specifically:

[0050] If the IP address of the authorized person at each login is the same as the common IP address, the IP judgment factor of the authorized person at each login is set to 1; otherwise, the IP judgment factor of the authorized person at each login is set to 0.

[0051] If the current login IP address is the same as the commonly used IP address, it means that the authorized person's login is in line with his personal habits, and the possibility of abnormal login to the authorized account is very small, and the possibility of network resource leakage is also smaller; on the contrary, if the current login IP address is different from the commonly used IP address, it means that the authorized person's authorized account may be abnormally logged in. Based on the above analysis, in order to clearly distinguish whether the current login IP is the same as the commonly used IP address, the IP factor is set to 1 when they are the same, and the IP factor is set to 0 when they are different, so as to determine whether there is a possibility of network resource leakage.

[0052] It should be noted that the reason why the judgment factor is set to 1 or 0 in this embodiment is that it helps to reduce ambiguity in the subsequent process and facilitates understanding and implementation. If other values ​​are set, there will be certain complexity, which will affect the subsequent calculation. Therefore, combined with the idea of ​​logical operation, using 1 and 0 can more conveniently perform logical operations. In addition, the implementer can also set a reasonable value according to the specific situation, and this embodiment does not impose any special restrictions.

[0053] (3) Further, by analyzing the interval between the login period of each login and the daily login period, the number of logins within each login period, and the frequency of use of the IP address used for each login, the access change degree of the authorized person at each login is determined, specifically:

[0054] The access change degree of the authorized person when logging in for the i-th time The expression is: ; In the formula, It represents the access change degree of the authorized person when logging in for the i-th time; It represents the time interval between the authorized person's login period for the i-th login and the daily login period; It represents the difference between the number of logins during the login period when the authorized person logged in for the i-th time before the current moment and the number of logins during the daily login period; Indicates the IP judgment factor when the authorized person logs in for the i-th time; It indicates the usage frequency of the IP address of the authorized person at the time of the i-th login within the preset time before the current time; exp() indicates an exponential function with a natural constant as the base; Indicates a constant greater than 0 to prevent the denominator from being 0. The value of is set manually. The value of is 0.01. Under the premise of ensuring that the denominator is not 0 and does not excessively affect the calculation result, the implementer can also set it according to the specific situation. This embodiment does not impose any special restrictions.

[0055] It should be noted that there are many methods for measuring the difference between data. In this embodiment, the difference between the number of logins in the login period when the authorized person logged in for the i-th time before the current moment and the number of logins in the daily login period is measured by calculating the absolute value of the difference between the number of logins in the login period when the authorized person logged in for the i-th time before the current moment and the number of logins in the daily login period. The implementer may also use other methods for measuring the difference between data, such as the square of the difference or the ratio. This embodiment does not impose any special restrictions on the selection of the method for measuring the difference between data. In this embodiment, all methods involving measuring the difference between data use the method of taking the absolute value of the difference, which will not be described in detail in the following calculation process.

[0056] Furthermore, according to the access change degree of the authorized personnel each time they log in, it can be understood that if the authorized personnel usually log in to the authorized account within a specific time period, then logging in during an unconventional time period may indicate that the account is not used by the authorized personnel. Therefore, if the time interval between the authorized personnel's current login period and the daily login period is larger, and if the number of logins by the authorized personnel in the current login period is abnormally increased compared to the number of logins in the daily login period, it means that the account is being cracked or some form of attack is being carried out, and the possibility of network resource data leakage is greater. Therefore, the authorized personnel should be denied access at this time; in addition, if the judgment factor is 0, it means that the current login IP is different from the commonly used IP address, and the greater the access change degree, the greater the risk of network resource leakage;

[0057] On the contrary, if the time interval between the authorized personnel's current login period and the daily login period is smaller, and if the difference between the number of logins by the authorized personnel in the current login period and the number of logins in the daily login period is smaller, it means that the possibility of normal login by the authorized personnel at this time is greater, and the possibility of network resource leakage is smaller; in addition, if the judgment factor is 1, it means that the current login IP is the same as the commonly used IP address, the smaller the access change, and the smaller the risk of network resource leakage.

[0058] Step S3: between any two logins of the authorized account by the authorized personnel, the difference in the number of all business ports accessed, the similarity of the accessed business ports, and the interval between the start time of accessing the same business port are analyzed to determine the similarity between any two logins of the authorized personnel; based on the time interval between the login periods of any two logins and the similarity, the habit of the authorized personnel is determined; based on the average distribution of the access change degree of all the logins of the authorized personnel before the current moment, the extreme distribution of all the similarities, and the habit, the trust of the authorized personnel at the current moment is determined.

[0059] According to step S2, the access change degree of the current authorized person when accessing the network resource is constructed. In this way, it is judged whether the authorized person has normal access. However, the IP address can be disguised by using a virtual IP or replaced with a new device, etc., which leads to the inability to accurately complete the identity authentication of the authorized person when the change degree is directly used for judgment. Therefore, in this embodiment, the access log after each login of the authorized person is analyzed, and the trustworthiness of the authorized person at the current moment is evaluated based on the approximation between the authorized person's access habits and the real-time access operations. The specific process is as follows:

[0060] S301: Between any two logins of the authorized account by the authorized person, the difference in the number of all business ports accessed, the similarity of the accessed business ports, and the interval between the start time of accesses to the same business port are analyzed to determine the similarity between any two logins of the authorized person.

[0061] (1) Sort all the service ports accessed by the authorized personnel after each login in ascending order according to the access start time, and record the total number of the same service ports accessed between any two logins as the same port value between any two logins;

[0062] Furthermore, the number of service ports with the same access order between any two logins is recorded as the same-order access port value between any two logins.

[0063] It should be noted that in order to facilitate a clearer understanding of the specific methods for obtaining the same port value and the same-order access port value, the following examples are given for reference only. For example, the business ports accessed in chronological order during the p-th login are port 1, port 2, port 3, port 4, and port 5, and the business ports accessed in chronological order during the q-th login are port 2, port 3, port 4, and port 1. Then, the same business ports accessed between the p-th login and the q-th login are port 1, port 2, port 3, and port 4. At this time, the same port value is 4, that is, the access order is not considered at this time, only whether the accessed ports are the same is considered; the business ports with the same access order between the p-th login and the q-th login are port 2, port 3, and port 4. At this time, the same-order access port value is 3, that is, at this time, it is necessary to consider both the same access order and the same accessed ports.

[0064] (2) In order to determine the access habits of authorized personnel and whether they have abnormal access, the similarity between any two logins of authorized personnel to the service port and the interval between the start time of access to the same service port is analyzed to determine the similarity between any two logins of authorized personnel, so as to improve the security of network resource access, specifically:

[0065] The similarity between any two logins of an authorized person The expression is: ; In the formula, It indicates the difference in the number of all business ports accessed between any two logins of the authorized personnel; L indicates the ratio of the same port value to the port value accessed in the same order between any two logins of the authorized personnel; D indicates the same port value between any two logins of the authorized personnel; Indicates that the authorized personnel can access the The interval between the access start times of the same service port; Indicates a constant greater than 0 to prevent the denominator from being 0. The value of is set manually. The value of is 0.01. Under the premise of ensuring that the denominator is not 0 and does not excessively affect the calculation result, the implementer can also set it according to the specific situation. This embodiment does not impose any special restrictions.

[0066] According to the similarity between any two logins of authorized personnel, it can be understood that if the difference in the number of all business ports accessed between any two logins of authorized personnel is smaller, the ratio of the same port value to the same order access port value between any two logins of authorized personnel is smaller, and the number of ports accessed between any two logins of authorized personnel is The smaller the interval between the start times of access to the same service port, the greater the similarity between any two logins, indicating that the two login situations of the authorized personnel are more similar, indicating that the possibility that the authorized personnel can access the network resources normally is greater, and the authorized personnel are allowed to access at this time;

[0067] On the contrary, if the difference in the number of all business ports accessed between any two logins of the authorized personnel is greater, the ratio of the same port value to the same order access port value between any two logins of the authorized personnel is greater, and the number of ports accessed between any two logins is greater. The larger the interval between the start times of access to the same service port, the smaller the similarity between any two logins, which means that the similarity between the two corresponding login situations of the authorized personnel is smaller, which means that the possibility of the authorized personnel accessing network resources abnormally is greater, and the authorized personnel should be denied access at this time.

[0068] S302: Determine the habit of the authorized person based on the time interval between any two login periods and the similarity; determine the trust of the authorized person at the current moment based on the average distribution of access changes during all logins of the authorized person before the current moment, the extreme distribution of all the similarities, and the habit.

[0069] For the authorized personnel working on the ship, when their duties have not changed and no abnormal events have occurred, the business ports and operations that the authorized personnel need to access for daily work are usually unchanged. Therefore, in this embodiment, the habituality is constructed through the differences in access operations during different accesses. The greater the habituality, the more habitual the operations of the authorized personnel during access are. Further, based on the habituality, access change degree and similarity, the trustworthiness of the authorized personnel at the current moment is determined, specifically:

[0070] (1) Calculate the time interval between any two logins of the authorized person, record it as the login interval, and take the average of all login intervals as a normalized value. Take the ratio of the average of the similarity between all logins of the authorized person to the normalized value as the habituality of the authorized person, which is used to characterize the access habits of the authorized person. If the similarity between any two logins is greater, the time interval between the login periods is smaller, and the habituality is greater, it means that the authorized person has normal access; conversely, if the similarity between any two logins is smaller, the time interval between the login periods is larger, and the habituality is smaller, it means that the authorized person is more likely to have abnormal access.

[0071] In particular, if the login periods are the same or one login period includes another login period, the average of the similarities between all logins of the authorized person is directly used as the habitual degree of the authorized person.

[0072] (2) Further, the average of the access change degrees of all the authorized personnel's logins before the current moment is calculated; the maximum value of the approximation between all the authorized personnel's logins before the current moment is obtained, and the product of the maximum value and the habit degree is divided by the average of the access change degrees, which is used as the trustworthiness of the authorized personnel at the current moment.

[0073] According to the trust of the authorized personnel at the current moment, it can be understood that if the similarity is greater, the habit is greater, the trust is greater, which means that the authorized personnel can be allowed to access the network resources in the ship network system at the current moment; conversely, if the similarity is smaller, the habit is smaller, the trust is smaller, which means that the authorized personnel should be denied access to the network resources in the ship network system at the current moment.

[0074] Step S4: Based on the difference between the upstream and downstream traffic at the current moment, and the difference between the throughput and the throughput limit value, determine the network attack value at the current moment, and combine the trust to determine the trust correction value of the authorized personnel at the current moment to control access to network resources.

[0075] According to step S3, the trust index of the authorized personnel in real-time access status is constructed. Since the trust is constructed through personal behavior habits and login environment, when the ship network system is attacked by network attacks, even if the authorized personnel have a high trust, they may be hijacked by network attacks or viruses, resulting in data leakage and account loss. At the same time, when the network system is attacked by network attacks, in order to avoid data leakage and account loss, the authorized personnel should be forced offline.

[0076] Therefore, in this embodiment, the network traffic data is monitored to construct a network attack value, and the network attack value is used as a correction indicator of the trust level to correct the trust level, obtain the corrected trust level, and perform real-time control on the access of authorized personnel based on the corrected trust level. The specific process is as follows:

[0077] When attacked, network traffic may suddenly surge, abnormal IP communications may occur, and transmitted data packets may contain malicious payloads. Therefore, traffic analysis tools such as Wireshark and Suricata are used to detect whether the transmitted data packets contain malicious payloads. This process is well known and will not be described in detail here.

[0078] Use traffic analysis tools to determine whether there is a malicious payload in the data packet transmitted by the ship network system at the current moment. If there is a malicious payload in the data packet, the malicious attack value at the current moment is set to 1, otherwise, the malicious attack value at the current moment is set to 0;

[0079] The current network attack value The expression is: ; In the formula, Indicates the ratio between upstream and downstream traffic at the current moment; Indicates the difference between the throughput at the current moment and the throughput limit value; represents the malicious attack value at the current moment; norm[ ] represents the normalization function.

[0080] According to the network attack value at the current moment, it can be understood that if the malicious attack value is 1, and the larger the ratio of upstream and downstream traffic, the larger the difference between the throughput and the throughput limit value, the throughput at this time is much higher than the throughput limit value, indicating that the network resources are under serious malicious attacks at this time. The larger the network attack value obtained, the more authorized personnel should be denied access at this time; conversely, if the malicious attack value is 0, and the smaller the ratio of upstream and downstream traffic, the smaller the difference between the throughput and the throughput limit value, it means that the network environment is relatively safe at this time, and the smaller the network attack value obtained, the authorized personnel can be allowed to access the network resources at this time.

[0081] The trust value of the authorized person at the current moment The expression is: ; In the formula, represents the trust level of the authorized person at the current moment; norm[ ] represents the normalization function.

[0082] If the trust correction value of the authorized personnel at the current moment is greater than the preset threshold, it means that the possibility of data leakage risk of the authorized personnel is smaller, and the authorized personnel is allowed to access the network resources of the ship network system; conversely, if the trust correction value of the authorized personnel at the current moment is less than or equal to the preset threshold, it means that the authorized personnel's access has the risk of data leakage, and the authorized personnel is denied access to the network resources of the ship network system.

[0083] Preferably, the schematic diagram of the trust correction value extraction process provided in this embodiment is as follows: Figure 2 shown.

[0084] It should be noted that the value of the preset threshold is artificially set. In this embodiment, the value of the preset threshold is 0.7. The implementer can also set it by himself according to the specific situation. This embodiment does not impose any special restrictions.

[0085] It should be noted that the above sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above is a description of a specific embodiment of this specification. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0086] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0087] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Modifications to the technical solutions recorded in the aforementioned embodiments, or equivalent replacement of some of the technical features therein, do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network resource access control method for a ship network system, characterized in that: The method comprises the following steps: During the process of accessing the network resources of the ship network system, obtain the number of times the authorized personnel have logged into the authorized account within the preset time before the current moment, the IP address and login time period of each login, and all the service ports accessed after each login and their respective access start time; obtain the upstream and downstream traffic, throughput and throughput limit value of the ship network system at the current moment; The number of logins for each IP address and each login period before the current moment is counted respectively to obtain the commonly used IP addresses and daily login periods of the authorized personnel; based on the difference between the IP address at each login and the commonly used IP address, the IP judgment factor at each login of the authorized personnel is determined, and the access change degree of the authorized personnel at each login is determined in combination with the time interval between the login period at each login and the daily login period, the difference in the number of logins between the login period and the daily login period, and the frequency of use of the IP address used at each login; Between any two logins, analyze the difference in the number of all service ports accessed, the similarity of access to service ports, and the interval between the start time of access to the same service port to determine the similarity between any two logins of the authorized personnel; Based on the time interval and the similarity between any two login periods, the habit of the authorized person is determined; based on the average distribution of the access change degree of all logins before the current moment, the distribution of all the similarities, and the habit, the trust of the authorized person at the current moment is determined; Based on the difference between the upstream and downstream traffic, and the difference between the throughput and the throughput limit value, the network attack value at the current moment is determined, and combined with the trust, the trust correction value of the authorized personnel at the current moment is determined to control access to network resources.

2. The network resource access control method for a ship network system according to claim 1, characterized in that: The method for obtaining the authorized personnel's commonly used IP addresses and daily login time periods is as follows: Among all IP addresses of the authorized personnel, the IP address with the most login times is used as the authorized personnel's common IP address; among all login periods of the authorized personnel, the login period with the most login times is used as the authorized personnel's daily login period.

3. The network resource access control method for a ship network system according to claim 1, characterized in that: The method for determining the IP judgment factor each time the authorized person logs in is as follows: If the IP address of the authorized person at each login is the same as the common IP address, the IP judgment factor of the authorized person at each login is set to 1; otherwise, the IP judgment factor of the authorized person at each login is set to 0.

4. The network resource access control method for a ship network system according to claim 1, characterized in that: The expression of the access change degree of the authorized personnel each time they log in is: ; In the formula, It represents the access change degree of the authorized person when logging in for the i-th time; It represents the time interval between the authorized person's login period for the i-th login and the daily login period; It represents the difference between the number of logins during the login period when the authorized person logged in for the i-th time before the current moment and the number of logins during the daily login period; Indicates the IP judgment factor when the authorized person logs in for the i-th time; It indicates the usage frequency of the IP address of the authorized person at the time of the i-th login within the preset time before the current time; exp() indicates an exponential function with a natural constant as the base; Indicates a preset constant greater than 0.

5. The network resource access control method for a ship network system according to claim 1, characterized in that: The method for determining the similarity between any two logins of the authorized personnel is: All business ports accessed by the authorized personnel after each login are sorted in ascending order according to the access start time, and the total number of the same business ports accessed between any two logins is recorded as the same port value between any two logins; The number of service ports with the same access order between any two logins is recorded as the same-order access port value between any two logins; The similarity between any two logins of an authorized person The expression is: ; In the formula, It indicates the difference in the number of all business ports accessed between any two logins of the authorized personnel; L indicates the ratio of the same port value to the port value accessed in the same order between any two logins of the authorized personnel; D indicates the same port value between any two logins of the authorized personnel; Indicates that the authorized personnel can access the The interval between the access start times of the same service port; Indicates a preset constant greater than 0.

6. The network resource access control method for a ship network system according to claim 1, characterized in that: The method for determining the habitual degree of the authorized personnel is: The time interval between any two logins of the authorized person is calculated and recorded as the login interval. The mean of all login intervals is normalized and the ratio of the mean of the similarity between all logins of the authorized person to the normalized value is taken as the habituation of the authorized person.

7. The network resource access control method for a ship network system according to claim 1, characterized in that: The method for determining the trustworthiness of the authorized person at the current moment is: Calculate the average value of the access change degree of all authorized personnel's logins before the current moment; The maximum value of the approximations between all logins of the authorized person before the current moment is obtained, and the product of the maximum value and the habit degree is divided by the mean of the access change degree to be used as the trust degree of the authorized person at the current moment.

8. The network resource access control method for a ship network system according to claim 1, characterized in that: The method for determining the network attack value at the current moment is: Use traffic analysis tools to determine whether there is a malicious payload in the data packet transmitted by the ship network system at the current moment. If there is a malicious payload in the data packet, the malicious attack value at the current moment is set to 1, otherwise, the malicious attack value at the current moment is set to 0; The current network attack value The expression is: ; In the formula, Indicates the ratio between upstream and downstream traffic at the current moment; Indicates the difference between the throughput at the current moment and the throughput limit value; represents the malicious attack value at the current moment; norm[ ] represents the normalization function.

9. The network resource access control method for a ship network system according to claim 8, characterized in that: The expression of the trust correction value of the authorized person at the current moment is: ; In the formula, Indicates the trust correction value of the authorized person at the current moment; represents the trust level of the authorized person at the current moment; norm[ ] represents the normalization function.

10. The network resource access control method for a ship network system according to claim 1, characterized in that: The control of access to network resources includes: If the trust correction value of the authorized person at the current moment is greater than the preset threshold, the authorized person is allowed to access the network resources of the ship network system; otherwise, the authorized person is denied access to the network resources of the ship network system.

Images