A network security management method based on communication data processing

Abstract

The present invention belongs to the field of network security technology, and provides a network security management method based on communication data processing. When obtaining the neighbor nodes of the current node in the relationship graph, the present invention selects the most important neighbor node among all the neighbor nodes in the same group as the representative neighbor node, and determines the merged group of the current node by analyzing the closeness characteristics of the groups before and after the current node joins the group where each representative neighbor node is located, merges the current node, and finally constructs the group relationship graph of the enterprise, identifies abnormal network traffic, and completes network security monitoring. The method provided by the present invention can effectively reduce the amount of calculation and reduce the complexity of the algorithm.

Description

Technical Field

[0001] The present invention relates to the technical field of data protection, and in particular to a network security management method based on communication data processing. Background Art

[0002] With the development of Internet technology, the innovation and application of the Internet are changing with each passing day. The network has not only changed people's daily lives, but also changed the operation mode and survival status of modern enterprises. Whether it is an Internet enterprise or a traditional manufacturing, service, financial industry, etc., they cannot do without the enterprise network to maintain the normal operation and profit of the enterprise. Enterprise employees can complete their work efficiently and communicate with each other under the enterprise network. Enterprise managers can also use the enterprise network to better manage enterprise employees and improve management efficiency.

[0003] Traffic data between enterprise employees is a direct reflection of communication activities, and traffic data between employees can reflect the existence of a group. If a group of employees interact frequently with each other and have relatively little traffic with other employees, this may indicate that they form a small group. Under normal circumstances, communication between groups has a fixed pattern and structure. When there is abnormal intrusion behavior in the network, abnormal traffic data will be generated. This abnormal traffic data will break the connection between nodes in the group relationship graph, and the group relationship will change. Therefore, a group relationship graph can be constructed through traffic data. According to the performance of traffic data in the group relationship graph, it is analyzed whether the connection relationship between enterprise employees conforms to the normal group relationship pattern, so as to determine the abnormal traffic data in the enterprise based on the connection relationship.

[0004] When constructing a group relationship graph, we usually add a node to its neighbor nodes, analyze the changes in group performance characteristics before and after the node joins, determine which group the node should belong to, and complete the merger of the node and its neighbor nodes. However, when multiple neighbor nodes of the current node are in the same group, analyzing the changes in group performance characteristics before and after the current node joins each neighbor node's group in turn will result in repeated calculations, increasing the amount of calculations and making the algorithm more complex. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a network security management method based on communication data processing.

[0006] According to a network security management method based on communication data processing provided by the present invention, the method comprises:

[0007] Obtain traffic data and communication frequency between employees;

[0008] Determine, based on the traffic data, contact employees of each of the employees and reference employees who have a communication relationship with the contact employees, and define an initial group;

[0009] Analyze the communication coverage of the employee based on the traffic data to obtain the confidence level of the employee;

[0010] Based on the communication frequency and in combination with the confidence level, analyzing the importance of the contact employees of the current employee in the initial group to which the current employee belongs, and determining the representative contact employee of the employee in the initial group;

[0011] Add the current employee to the initial group to which the representative contacted employee belongs, to obtain an updated group;

[0012] Based on the communication frequency, analyzing the closeness of the initial group and the updated group to obtain a merged group of current employees;

[0013] Traverse all employees and build a group relationship diagram;

[0014] Based on the group relationship diagram, the abnormality of network traffic is analyzed to complete network security monitoring.

[0015] In some embodiments of the present invention, the traffic data includes source address, destination address, data packet size, and sending time.

[0016] In some embodiments of the present invention, analyzing the communication coverage of the employee based on the traffic data to obtain the confidence of the employee includes:

[0017] Analyzing the similarity of the employee communication content according to the data packet size and the sending time;

[0018] According to the similarity of the communication contents, identifying messages sent in the same batch, and obtaining a set of messages sent in the same batch;

[0019] Based on the set of messages sent in the same batch, the confidence level of the employee is obtained.

[0020] In some embodiments of the present invention, analyzing the similarity of the employee communication content according to the data packet size and the sending time includes:

[0021] Analyzing the consistency of data packets sent by the employees at adjacent times according to the data packet size;

[0022] Analyzing the consistency of the sending times of the employees at adjacent sending times according to the sending times;

[0023] The similarity of the employee communication contents is obtained according to the consistency of the data packets and the consistency of the sending time.

[0024] In some embodiments of the present invention, obtaining the confidence level of the employee based on the set of messages sent in the same batch includes:

[0025] The number of messages in the message set sent in the same batch and the difference in number of different message sets sent in the same batch are analyzed to obtain the confidence of the employee.

[0026] In some embodiments of the present invention, based on the communication frequency and in combination with the confidence, analyzing the importance of the contact employees of the current employee in the initial group to which the current employee belongs, and determining the representative contact employee of the employee in the initial group includes:

[0027] Based on the communication frequency, in the initial group to which the current employee's contact employees belong, the communication difference between the contact employee and the corresponding reference employee is analyzed, and the importance of the contact employee in the initial group to which the contact employee belongs is obtained by combining the confidence corresponding to the reference employee and the proportion of the reference employee in the initial group;

[0028] Based on the importance, a representative contact employee of the employee in the initial group is determined.

[0029] In some embodiments of the present invention, determining, according to the importance, a representative contact employee of the employee in the initial group includes:

[0030] All contact employees of the current employee in the same initial group are traversed to obtain the maximum importance value of all contact employees in the same initial group. The contact employee corresponding to the maximum importance value is the representative contact employee of the employee in the initial group.

[0031] In some embodiments of the present invention, analyzing the closeness of the initial group based on the communication frequency includes:

[0032] Based on the communication frequency, analyzing the relationship between the communication frequency in the initial group and the sum of the communication frequencies in all initial groups to obtain the apparent closeness;

[0033] Counting the number of contacted employees of all employees in the initial group, combining the confidence of the employees, and combining the total communication frequency in all initial groups, to obtain interference parameters;

[0034] The compactness of the initial population is obtained according to the apparent compactness and the interference parameter.

[0035] In some embodiments of the present invention, based on the communication frequency, analyzing the closeness of the initial group and the updated group to obtain a merged group of current employees includes:

[0036] Based on the communication frequency, obtaining the compactness of the initial group and the compactness of the updated group;

[0037] Calculate the difference between the closeness of the updated group and the closeness of the initial group to obtain the influence of the current employee on the initial group;

[0038] Traverse all representatives of the current employee and contact the initial group to which the employee belongs with the corresponding updated group to obtain the maximum influence;

[0039] The current employee is merged into the initial group corresponding to the maximum influence.

[0040] In some embodiments of the present invention, based on the group relationship diagram, the abnormality of network traffic is analyzed to complete network security monitoring, including:

[0041] Based on the group relationship diagram, the number of connection lines between any two groups is counted, and the communication frequency between any two groups under normal conditions and on the day is counted to obtain the communication probability difference;

[0042] A difference threshold is preset, and abnormal network traffic is identified based on the communication probability difference to complete network security monitoring.

[0043] It can be seen from the above embodiments that the network security management method based on communication data processing provided by the embodiments of the present invention has the following beneficial effects:

[0044] 1. When obtaining the neighbor nodes of the current node in the relationship graph, the present invention selects the neighbor node with the greatest importance among all neighbor nodes in the same group as the representative neighbor node, determines the merged group of the current node according to the closeness characteristics of the groups before and after the current node joins each representative neighbor node, merges the current node, and finally constructs the group relationship graph of the enterprise, thereby reducing the amount of calculation and the complexity of the algorithm;

[0045] 2. Considering that some employees of an enterprise are only responsible for the transmission, forwarding or copying of messages, the employee may have relevant contacts with different groups. At this time, the relationship between the employee and the above employees cannot truly represent the group relationship between the two. The present invention analyzes the communication coverage of each employee to obtain the employee's confidence, which is used as the weight for the importance analysis of the contact employee in the initial group to which he belongs, weakens the relationship between the employee whose job nature is only message transmission and other employees, and improves the accuracy of employee importance analysis;

[0046] 3. Under normal circumstances, the communication between groups has a fixed pattern and structure. When there is abnormal intrusion behavior, the relationship between groups will change. Therefore, the present invention analyzes the abnormality of network traffic based on the group relationship graph, and can quickly and accurately identify network traffic anomalies, thereby ensuring the internal network security of the enterprise.

[0047] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A basic flow chart of a network security management method based on communication data processing provided by an embodiment of the present invention;

[0050] Figure 2 A relationship diagram of communication between employees provided by an embodiment of the present invention;

[0051] Figure 3 A group relationship diagram of an enterprise provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the specific implementation method, structure, features and effects of a network security management method based on communication data processing proposed by the present invention in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. Terms such as "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a circuit structure, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such article or device. In the absence of further restrictions, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the article or device including the element.

[0054] A network security management method based on communication data processing provided by this embodiment will be described in detail below with reference to the accompanying drawings.

[0055] See also Figure 1, which shows the basic process of a network security management method based on communication data processing provided by an embodiment of the present invention.

[0056] like Figure 1 As shown, an embodiment of the present invention provides a network security management method based on communication data processing, which specifically includes the following steps:

[0057] S100: Obtain traffic data and communication frequency between employees.

[0058] Wireshark is an open source network protocol analysis tool that can capture and analyze network traffic. It supports multiple protocols and packet formats and can display detailed information about network traffic.

[0059] The traffic data between employees of an enterprise is a direct reflection of communication activities, and the traffic data between employees can reflect the characteristics of a group. Employees of an enterprise often use emails for formal work communication or to send important documents. Therefore, when an employee sends an email, the traffic data from the IP of the device where the employee's email client is located to the enterprise's email server can be captured through the Wireshark toolkit, where the traffic data includes the source address (sender device IP address), destination address (receiver device IP address), data packet size, and sending time. The Wireshark toolkit is used to obtain the traffic data of a certain enterprise in the past week. The content of a traffic data is expressed as [sender device IP address, receiver device IP address, data packet size, and sending time]. In addition, the frequency of one-way communication between any employee and other employees is also obtained.

[0060] S200: Determine, based on the traffic data, contact employees of each of the employees and reference employees who have a communication relationship with the contact employees, and define an initial group.

[0061] According to the flow data, the contact employees of each employee and the reference employees who have a communication relationship with the contact employees are determined to define an initial group. The specific implementation method is: according to the flow data, a relationship diagram of the communication between employees is constructed, such as Figure 2 As shown, a node in the relationship graph represents an employee, and the connection between employees represents the communication between employees. The weight of the connection in the relationship graph is represented by the closeness of the connection between employees (the frequency of communication established between employees). Through the relationship graph, the contact employees who have a communication relationship with each of the employees and the reference employees who have a communication relationship with the contact employees can be obtained. In the initial operation, each employee in the relationship graph can be regarded as an initial group.

[0062] At this point, we have obtained the initialized relationship graph and the initial group. Next, we will build the subsequent group relationship graph and analyze abnormal data based on the initialized relationship graph and the initial group.

[0063] When constructing a group relationship graph, it is usually done by adding a node to its neighboring nodes, analyzing the changes in group performance characteristics before and after the node is added, determining that the node should belong to a group, and completing the merger of the node and its neighboring nodes. However, in the relationship graph, an employee generally has multiple contact employees, and some of these contact employees may exist in the same group. The relationship between contact employees in the same group is closer and similar. At this time, when a contact employee in the same group performs more important in the group, it means that the contact employee is more able to represent other contact employees in the same group as the representative contact employee of the current employee. Therefore, the representative contact employee of the current employee, that is, the neighbor node of the node, can be determined by calculating the importance of each contact employee in the same group. The specific steps include S300 and S400.

[0064] S300: Analyze the communication coverage of the employee based on the traffic data to obtain the confidence level of the employee.

[0065] Due to the nature of work in some companies, some employees are only responsible for the delivery, forwarding or copying of messages. This employee may have close contacts with different groups, but the relationship between this employee and other employees cannot truly reflect the group relationship between the two. Therefore, when calculating the importance of the contact employee in the group, it is necessary to determine the confidence of each contact employee in the group. If the employee's message coverage in the network is large, then it is more likely that the nature of the employee's work is only message delivery, that is, the less real the relationship between this employee and other employees, the smaller the confidence. Therefore, the confidence of group employees can be expressed by analyzing the coverage of the messages sent by employees.

[0066] Based on the above analysis, in an embodiment of the present invention, the communication coverage of the employee is analyzed based on the traffic data to obtain the confidence of the employee.

[0067] The coverage of an employee's message sending can be represented by the number of messages sent by the employee in the same batch. The more messages sent in the same batch, the larger the coverage of the employee's message sending. Sending messages in the same batch can be represented by sending data with the same data packet size multiple times within the same time. Therefore, based on the traffic data, the communication coverage of the employee is analyzed to obtain the confidence of the employee, which further includes:

[0068] First, according to the packet size and the sending time, the similarity of the employee communication content is analyzed. The specific implementation method is: obtain the employee's traffic data for the past month, including the sending time and packet size, and form a sequence of packet sizes according to the sending time, which is expressed as ,in Indicates the sending time The size of the data packet sent by the employee at that time. When the adjacent sending times in the message sequence are closer and the difference in data packet sizes is smaller, it means that the messages sent at adjacent sending times may be messages sent in the same batch. Therefore, according to the data packet size, the consistency of the data packets of the adjacent sending times of the employee is analyzed; according to the sending time, the consistency of the sending time of the adjacent sending times of the employee is analyzed; according to the consistency of the data packets and the consistency of the sending time, the similarity of the communication content of the employee at the adjacent sending time is obtained. Construct the first Employees send at adjacent times and sending time The communication content similarity calculation formula is:

[0069]

[0070] In the formula, Indicates Employees send at adjacent times and sending time Similarity of communication content; Indicates Employees sending time The size of the data packet sent by the employee; Indicates Employees sending time The size of the data packet sent by the employee; Indicates Employees sent time the specific moment of Indicates Employees sent time the specific moment of Expressed as a natural constant An exponential function with base .

[0071] Indicates the difference in the size of data packets sent at adjacent times. The smaller the value, the greater the consistency of data packets sent at adjacent times, that is, the greater the similarity of the communication content of employees at adjacent sending times; It indicates the difference between the corresponding moments of adjacent sending times. The smaller the value, the greater the consistency of the sending times of adjacent sending times, that is, the greater the similarity of the communication content of employees at adjacent sending times.

[0072] Similarly, the similarity of the communication content of all adjacent sending times in each employee's message sequence can be obtained.

[0073] Then, based on the similarity of the communication content, the messages sent in the same batch are identified to obtain a set of messages sent in the same batch. The specific implementation method is as follows: the similarity of the communication content of all adjacent sending times in the message sequence of each employee is obtained above, The smaller the value, the more likely it is that messages sent at adjacent times are sent in the same batch. The threshold is set to 0.4. Messages with adjacent sending times are considered as messages sent in the same batch. In the message sequence, the messages sent in the same batch and at adjacent sending times are merged. For example, Employees send at adjacent times and sending time Similarity of communication content , and adjacent sending time and sending time Similarity of communication content , then the sending time , Sending time and sending time The messages are messages sent in the same batch. They are merged and all adjacent sending times are traversed in sequence until the communication content similarity is greater than or equal to 0.4. The merging is stopped to form a set of messages sent in the same batch. Finally, multiple sets of messages sent in the same batch are obtained. The number of messages in each set of messages sent in the same batch is the number of messages sent in the same batch.

[0074] Based on the set of messages sent in the same batch, the confidence of the employee is obtained. The specific implementation method is: when the number of messages sent in the same batch is greater, that is, the number of messages in the set of messages sent in the same batch is greater, it means that the coverage of the employee's messages is greater. At the same time, when the difference in the number of messages in any two sets of messages sent in the same batch is smaller (when an employee sends a file, each time it is sent to a fixed number of recipients), it means that the employee's confidence is smaller. Therefore, by analyzing the number of messages in the set of messages sent in the same batch, and the difference in the number of different sets of messages sent in the same batch, the confidence of the employee is obtained. Construct the first The confidence calculation formula for an employee is:

[0075]

[0076] In the formula, Indicates The confidence level of each employee; Indicates A collection of messages sent in batches by employees The amount of information in Indicates the number of message sets sent in the same batch, that is, the number of times messages are sent in the same batch; Indicates the A collection of messages sent in batches by employees The amount of information in express Type growth curve; represents the linear normalization function.

[0077] It indicates the mean number of messages in all messages sent in the same batch. The larger the value, the more messages the employee sends in the same batch, which means the coverage of the messages sent by the employee is large, indicating that the confidence of the employee is smaller. Indicates that among all the messages sent in the same batch, any message set sent in the same batch Send messages in the same batch The smaller the value, the smaller the employee sends files to a fixed number of recipients each time, indicating that the employee's confidence is lower; in general, when the number of messages sent in the same batch is larger and the difference in the number of messages in any set of messages sent in the same batch is smaller, it means that the nature of the employee's work is only to spread messages, which may be related to other employees, so his confidence is The smaller.

[0078] S400: Based on the communication frequency and in combination with the confidence level, analyzing the importance of the contact employees of the current employee in the initial group to which he belongs, and determining the representative contact employee of the employee in the initial group.

[0079] When a contact employee in the same group performs more important in the group, it means that the contact employee is more representative of other contact employees in the same group and serves as the representative contact employee of the current employee. Therefore, in an embodiment of the present invention, based on the communication frequency and combined with the confidence, the importance of the contact employees of the current employee in the initial group to which they belong is analyzed to determine the representative contact employee of the employee in the initial group. It should be noted that the initial group is the group divided during the initial operation. When some employees complete the group merger, the initial group of this step is replaced by the updated group. This embodiment is described by taking the initial group as an example.

[0080] The relationship between nodes in the relationship graph is directional, that is, when node A sends a message to node B, the connection at this time is from node A to node B. When the connection weight from node A to node B is greater than the connection weight from node B to node A, from the perspective of the relationship between employees, when the communication frequency of employee A to employee B is greater than the communication frequency of employee B to employee A, and at the same time, the larger the proportion of the number of contact employees in the group to which the contact employee belongs to the number of all employees in the group, it means that the contact employee is more important in the group. Therefore, the specific implementation method is:

[0081] First, based on the communication frequency, in the initial group of the current employee's contact employees, the communication differences between the contact employee and his corresponding reference employee are analyzed, and the importance of the contact employee in the initial group is obtained by combining the confidence level of the reference employee and the proportion of the reference employee in the initial group. Employee's The formula for calculating the importance of a contact employee in his initial group is:

[0082]

[0083] In the formula, Indicates Employee's The importance of the individual contact person to their initial group; Indicates The number of reference employees (contact employees of contact employees) of each contact in his / her initial group; Indicates Contact Person The frequency of communication by the reference employee sending messages; Indicates Reference employees to The frequency of communication by each contact person; Indicates Contact Person The confidence level of a reference employee is obtained through step S400; Indicates The number of all employees in the initial group of the contact employee; represents the linear normalization function.

[0084] Indicates Contact Person The communication difference between the reference employees. The larger the value, the more likely the contact employee is the initiator of the communication. He or she may be a leader, so the contact employee is more important. Indicates The ratio of the number of reference employees of a contact employee to the number of employees in the initial group. The larger the value, the more contacts the contact employee has, which means that the contact employee has a larger communication coverage, and therefore the contact employee is more important. Combined with the confidence of the reference employee, the interference of employees whose job is only to spread information can be eliminated.

[0085] Similarly, we can get The importance of all connected employees in the same initial group.

[0086] Then, based on the importance, determine the representative contact employee of the employee in the initial group. The specific implementation method is: traverse all the contact employees of the current employee in the same initial group, and obtain the maximum value of the importance corresponding to all the contact employees in the same initial group. The contact employee corresponding to the maximum value is the representative contact employee of the employee in the initial group. Similarly, traverse all the initial groups where all the contact employees of the current employee are located, and determine the representative contact employee of the current employee in each initial group. It should be noted that if there is only one contact employee of the current employee in a group, then the contact employee is the representative contact employee, and there is no need to calculate its importance. The above-mentioned multiple representative contact employees are the neighbor nodes (representative contact employees) of the current node (current employee).

[0087] S500: Add the current employee to the initial group to which the representative contact employee belongs, to obtain an updated group.

[0088] Through step S400, multiple representative contact employees of the current employee are obtained, and the current employee is added to the initial group to which each representative contact employee belongs, thereby obtaining multiple updated groups. Next, by analyzing the changes in the characteristics of the initial group before and after the current employee joins the initial group to which each representative contact employee belongs, the group to which the current employee should belong is determined.

[0089] S600: Based on the communication frequency, analyze the closeness of the initial group and the updated group to obtain a merged group of current employees.

[0090] The relationship between employees in a group is measured by the closeness of the group. The closeness of a group indicates the frequency of communication among all employees in the group. The greater the closeness of a group, the more stable the group structure. For a current employee, if the closeness of the updated group obtained after joining the initial group increases more than the closeness of the initial group, then the employee should be merged with the initial group.

[0091] Based on the above analysis, in an embodiment of the present invention, based on the communication frequency, the closeness of the initial group and the updated group is analyzed to obtain a merged group of current employees.

[0092] The greater the ratio of the communication frequency between employees in a group and the total communication frequency of all employees in the overall relationship diagram, the closer the connection within the group is and the more frequent the information exchange between employees. In addition, if only the ratio is used for calculation, the calculation will be inaccurate, because even if the communication frequency ratio of employees in a group is high, it may be caused by random connections. For example, in a social activity scenario, employees communicate frequently in a short period of time because of a team-building activity (the communication frequency increases), but these exchanges may just be small talk about the team-building activity, and the relationship between employees is relatively random and cannot be represented as a group.

[0093] Therefore, based on the communication frequency, the closeness of the initial group and the updated group is analyzed to obtain the merged group of current employees. The specific implementation method is as follows:

[0094] Take the compactness analysis of the initial group as an example:

[0095] Firstly, based on the communication frequency, the relationship between the communication frequency in the initial group and the sum of the communication frequencies in all initial groups is analyzed to obtain the apparent closeness.

[0096] Then, when the total number of employees contacted by all employees in the group (the degree of the node) accounts for the total communication frequency in the relationship graph, the smaller the ratio is, the more it indicates that the communication between employees has a fixed form, eliminating the influence of random relationships among employees in the group; at the same time, when determining the total number of employees contacted by an employee, if the nature of the employee's work is to only send messages for dissemination, the node degree of the employee cannot be used to represent the random relationship between employees in the group, and the confidence of the employee in the group can be used as the weight of the degree of the employee node. Therefore, the number of employees contacted by all employees in the initial group is counted, combined with the confidence of the employee, and combined with the sum of the communication frequencies in all initial groups, to obtain the interference parameter.

[0097] Finally, the compactness of the initial group is obtained according to the apparent compactness and the interference parameter. The calculation formula of the compactness is:

[0098]

[0099] In the formula, Represents the initial population The tightness of Indicates the frequency of communication between employees; Represents the initial population The frequency of all communications between employees and; It represents the sum of the communication frequencies among all employees in the relationship diagram; Represents the initial population Middle Number of employees contacted by each employee; Represents the initial population Middle The confidence level of each employee; Represents the initial population The number of all employees in .

[0100] The ratio of the communication frequency between employees in the initial group to the total communication frequency of all employees in the overall relationship diagram indicates the apparent closeness. The larger the value, the more frequent the internal communication in the initial group, indicating that the closeness of the initial group is greater; the confidence of employees As a weight, it means that when the nature of an employee's job is to only send messages, the corresponding weight of the number of employees contacted by the employee is small. represents the total number of contact employees of all employees in the initial group, Represents the interference parameter, which is used to correct the apparent tightness. The smaller it is, the more stable the relationship between employees in the group.

[0101] Similarly, the compactness of the updated group is obtained.

[0102] According to the above analysis, all the representative contact employees of the current employee can be obtained. After the current employee joins a group to which a representative contact employee belongs, the closeness of the group to which the representative contact employee belongs increases, indicating that the current employee belongs more to this group. Therefore, by calculating the increase in the closeness of each representative contact employee's group before and after the current employee joins, the group that the current employee needs to join is determined. The specific implementation method is: based on the communication frequency, the closeness of the initial group and the closeness of the updated group are obtained; the difference between the closeness of the updated group and the closeness of the initial group is calculated to obtain the influence of the current employee on the initial group; the initial group and the corresponding updated group to which all the representative contact employees of the current employee belong are traversed to obtain the maximum influence; the current employee is merged into the initial group corresponding to the maximum influence. The specific calculation formula is expressed as:

[0103]

[0104] In the formula, Indicates that the Employees merged into Representative Contact Employee The group you belong to; Indicates Employees merged into Representative Contact Employee The closeness of the updated group obtained after the initial group; Indicates Employee representatives contact employees The closeness of the initial group; Represents the maximum value function.

[0105] Indicates that the current employee is merged into the representative contact employee The increase in group compactness after the initial group, Indicates the maximum value of the increase in closeness (and the increase is greater than 0). At this time, the maximum value of the increase in closeness corresponds to the representative contact employee The initial group is the group into which the current employees are merged.

[0106] S700: Traverse all employees and build a group relationship diagram.

[0107] Repeat steps S400 to S600 to traverse all employees, and continue to add each employee to the group until the increase in the closeness of the group is less than 0, indicating that the employee cannot be merged into other groups, completing the division of employee groups in the relationship diagram, and finally obtaining the group relationship diagram of the enterprise. Figure 3 As shown, the node in the circle represents a group.

[0108] S800: Based on the group relationship diagram, analyze the abnormality of network traffic and complete network security monitoring.

[0109] Anomaly detection is performed based on the connection relationship. Through the group relationship diagram constructed above, it is observed whether the connection relationship between employees conforms to the normal group relationship pattern. In a normal group relationship diagram, the communication connection between employees is usually formed based on factors such as work relationship and project team. If abnormal connections appear and the communication traffic of these connections is large, it may be abnormal traffic.

[0110] Based on the above analysis, in an embodiment of the present invention, based on the group relationship diagram, the abnormality of network traffic is analyzed to complete network security monitoring. The specific implementation method is: based on the group relationship diagram, the number of connection lines between any two groups is counted, and the normal situation and the communication frequency of the day between any two groups are counted, and the normal communication probability formula between any two groups is constructed as follows:

[0111]

[0112] In the formula, represents the probability of normal communication between any two groups, represents the number of connecting lines between any two groups; Represents the normal communication frequency between any two groups.

[0113] Similarly, we can get the communication probability between any two groups on the same day: .

[0114] Calculate the communication probability for the day Communication frequency with normal situation The difference , and obtain the communication probability difference. The preset difference threshold is 0.5. If the communication probability difference If it is greater than 0.5, it means that there is abnormal network traffic in the enterprise on that day, that is, there is abnormal traffic intrusion in the enterprise on that day, and network security monitoring is implemented.

[0115] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0116] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A network security management method based on communication data processing, characterized in that: The method comprises: Obtain traffic data and communication frequency between employees; Determine, based on the traffic data, contact employees of each of the employees and reference employees who have a communication relationship with the contact employees, and define an initial group; Analyze the communication coverage of the employee based on the traffic data to obtain the confidence level of the employee; Based on the communication frequency and in combination with the confidence level, analyzing the importance of the contact employees of the current employee in the initial group to which the current employee belongs, and determining the representative contact employee of the employee in the initial group; Add the current employee to the initial group to which the representative contacted employee belongs, to obtain an updated group; Based on the communication frequency, analyzing the closeness of the initial group and the updated group to obtain a merged group of current employees; Traverse all employees and build a group relationship diagram; Based on the group relationship diagram, the abnormality of network traffic is analyzed to complete network security monitoring.

2. The network security management method based on communication data processing according to claim 1 is characterized in that: The traffic data includes source address, destination address, data packet size, and sending time.

3. The network security management method based on communication data processing according to claim 2 is characterized in that: Based on the traffic data, the communication coverage of the employee is analyzed to obtain the confidence level of the employee, including: Analyzing the similarity of the employee communication content according to the data packet size and the sending time; According to the similarity of the communication contents, identifying messages sent in the same batch, and obtaining a set of messages sent in the same batch; Based on the set of messages sent in the same batch, the confidence level of the employee is obtained.

4. The network security management method based on communication data processing according to claim 3 is characterized in that: Analyzing the similarity of the employee communication content according to the data packet size and the sending time includes: Analyzing the consistency of data packets sent by the employees at adjacent times according to the data packet size; Analyzing the consistency of the sending times of the employees at adjacent sending times according to the sending times; The similarity of the employee communication contents is obtained according to the consistency of the data packets and the consistency of the sending time.

5. The network security management method based on communication data processing according to claim 3 is characterized in that: Based on the set of messages sent in the same batch, the confidence level of the employee is obtained, including: The number of messages in the message set sent in the same batch and the difference in number of different message sets sent in the same batch are analyzed to obtain the confidence of the employee.

6. The network security management method based on communication data processing according to claim 1 is characterized in that: Based on the communication frequency and in combination with the confidence level, analyzing the importance of the contact employee of the current employee in the initial group to which he belongs, and determining the representative contact employee of the employee in the initial group, including: Based on the communication frequency, in the initial group to which the current employee's contact employees belong, the communication difference between the contact employee and the corresponding reference employee is analyzed, and the importance of the contact employee in the initial group to which the contact employee belongs is obtained by combining the confidence corresponding to the reference employee and the proportion of the reference employee in the initial group; Based on the importance, a representative contact employee of the employee in the initial group is determined.

7. The network security management method based on communication data processing according to claim 6 is characterized in that: Based on the importance, determine the representative contact employees of the employee in the initial group, including: All contact employees of the current employee in the same initial group are traversed to obtain the maximum importance value of all contact employees in the same initial group. The contact employee corresponding to the maximum importance value is the representative contact employee of the employee in the initial group.

8. The network security management method based on communication data processing according to claim 1 is characterized in that: Analyzing the closeness of the initial group based on the communication frequency includes: Based on the communication frequency, analyzing the relationship between the communication frequency in the initial group and the sum of the communication frequencies in all initial groups to obtain the apparent closeness; Counting the number of contacted employees of all employees in the initial group, combining the confidence of the employees, and combining the total communication frequency in all initial groups, to obtain interference parameters; The compactness of the initial population is obtained according to the apparent compactness and the interference parameter.

9. The network security management method based on communication data processing according to claim 8 is characterized in that: Based on the communication frequency, the closeness of the initial group and the updated group is analyzed to obtain a merged group of current employees, including: Based on the communication frequency, obtaining the compactness of the initial group and the compactness of the updated group; Calculate the difference between the closeness of the updated group and the closeness of the initial group to obtain the influence of the current employee on the initial group; Traverse all representatives of the current employee and contact the initial group to which the employee belongs with the corresponding updated group to obtain the maximum influence; The current employee is merged into the initial group corresponding to the maximum influence.

10. The network security management method based on communication data processing according to claim 1, characterized in that: Based on the group relationship diagram, the abnormality of network traffic is analyzed to complete network security monitoring, including: Based on the group relationship diagram, the number of connection lines between any two groups is counted, and the communication frequency between any two groups under normal conditions and on the day is counted to obtain the communication probability difference; A difference threshold is preset, and abnormal network traffic is identified based on the communication probability difference to complete network security monitoring.

Images