Security auditing and compliance checking method in IPv6 (Internet Protocol Version 6) network

Abstract

The invention relates to the technical field of communication, in particular to a security auditing and compliance checking method in an IPv6 network. According to the method, the activity events in the detection period in the IPv6 network are obtained, the event logs of the activity events are generated, the activity items corresponding to the event logs are generated, the preset activity items are collected and stored, the event logs are subjected to safety auditing to generate the auditing logs of the corresponding levels, and the auditing efficiency is improved. The level distribution condition of each auditing log in the detection period is counted, evaluation is carried out on the IPv6 network based on the level distribution condition, the evaluation comprises safety auditing and compliance checking on the IPv6 network, and a corresponding processing instruction is generated or periodical evaluation on the IPv6 network is completed based on an evaluation result. And re-determining the operation parameters of the corresponding parts based on the received processing instruction. According to the invention, accurate security audit, compliance check and targeted adjustment of the IPv6 network are effectively realized according to the activity event, and the monitoring efficiency of the IPV6 network is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a security audit and compliance checking method in an IPv6 network. Background Art

[0002] IPv6 is the sixth version of the Internet Protocol. The address length of IPv6 is 128 bits, and the total number of IP addresses that can be provided is about 340 trillion. Compared with IPv4, IPv6 has a longer address length and can provide more total IP addresses, which effectively solves the problem that IPv4 cannot meet current and future network needs. As the next generation Internet protocol, IPv6 can provide sufficient address space and efficient network performance to meet the needs of future network development. Security audits of IPv6 networks can record network behavior, and IPv6 compliance checks can ensure that the network environment complies with relevant standards and regulations. Security audits and compliance checks of IPv6 networks can discover potential security risks and vulnerabilities and avoid security issues and data leaks caused by improper network configuration.

[0003] Chinese patent application publication number: CN116545984A, discloses a method and device for allocating IPV6 addresses. The method structures each IP segment in the acquired allocated segment information to generate a structured IP segment, establishes an IP segment information pool based on the structured IP segment, calculates the subnet number of each structured IP segment in the IP segment information pool based on the IP segment demand prefix received from the application end and the unit to which it belongs, thereby combining the subnet number and the network address prefix of the structured IP segment to generate a tuple set, and generates an allocated subnet number set based on the set and the IP segment demand prefix, takes any natural number that does not exist in the allocated subnet number set as an unallocated subnet number, performs a padding process to generate an unallocated IPV6 address and returns it to the application end.

[0004] It can be seen that the above solution can quickly and accurately generate unallocated IPV6 addresses and return them to the application side by receiving the IP network segment required prefix and the unit to which it belongs from the application side, thereby optimizing the user experience and improving the efficiency of generating unallocated IPV6 addresses. However, the above solution cannot perform accurate security audits, compliance checks, and targeted adjustments on the IPv6 network based on active events, and thus cannot guarantee the monitoring efficiency of the IPV6 network. Summary of the invention

[0005] To this end, the present invention provides a security audit and compliance check method in an IPv6 network, which is used to overcome the problem in the prior art that it is impossible to perform accurate security audit and compliance check and targeted adjustment on the IPv6 network according to activity events, thereby resulting in low monitoring efficiency for the IPV6 network.

[0006] To achieve the above object, the present invention provides a security audit and compliance checking method in an IPv6 network, comprising: Obtaining activity events within a detection period in the IPv6 network; Generate event logs for the activity events in sequence, and generate activity items corresponding to the event logs; Collecting and storing each preset activity item from the IPv6 network; Performing a security audit on each of the event logs to generate an audit log of a corresponding level; Counting the distribution of levels of the audit logs within the detection period; Assessing the IPv6 network based on the grade distribution; Generate corresponding processing instructions based on the evaluation results, or, completing the periodic assessment of the IPv6 network and assessing the IPv6 network in the next detection period; Wherein, the assessment includes conducting a security audit on the IPv6 network and conducting a compliance check on the IPv6 network; The operating parameters of the corresponding components are re-determined based on the received processing instructions.

[0007] Furthermore, the process of performing security audit on each of the event logs to generate the audit log of the corresponding level includes: For a single activity event, the activity items in the event log of the activity event include a time node, a terminal address, a type of request information, a digital signature, and a request result; A security audit is performed on each event log based on each of the activity items in each of the event logs, and audit logs of corresponding levels of each event log are generated according to the audit results.

[0008] Furthermore, the process of performing a security audit on each event log based on each of the activity items in each of the event logs, and generating each audit log of a corresponding level of each event log according to the audit result includes: Matching and comparing each of the activity items in a single event log with each of the preset activity items; When a single activity item is consistent with a single preset activity item, the activity item passes the matching comparison; Counting the number of the activity items that pass the matching comparison in a single event log, and recording the obtained number of activity items as the number of activity items; Calculate the ratio of the number of the activity items to the total number of the activity items, and record the obtained ratio as the matching item ratio; When the proportion of the matching items is greater than the proportion of the second preset matching items, the single event log is evaluated to have passed the security audit, and the corresponding audit log is recorded as a first-level audit log; When the proportion of the matching items is less than or equal to the proportion of the second preset matching items and greater than the proportion of the first preset matching items, performing a level evaluation on the audit log corresponding to the event log based on the request result; When the proportion of the matching items is less than or equal to the first preset proportion of the matching items, the single event log is evaluated as failing the security audit, and the corresponding audit log is recorded as a third-level audit log; The level evaluation of each audit log corresponding to each event log is completed in sequence.

[0009] Further, the process of performing the level evaluation on the audit log corresponding to the event log based on the request result includes: Obtaining a request result for the activity event corresponding to a single event log; When the request result is rejected, the single event log is evaluated as having passed the security audit, and the corresponding audit log is recorded as a secondary audit log; When the request result is passed, the single event log is evaluated as failing the security audit, and the corresponding audit log is recorded as a level 3 audit log.

[0010] Further, the process of evaluating the IPv6 network based on the grade distribution includes: When the level distribution is that the number of the first-level audit logs is greater than the number of the second-level audit logs and greater than the number of the third-level audit logs, assess that the IPv6 network has passed the security audit within the detection period, and assess the security audit of the IPv6 network in the next detection period; When the level distribution is that the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs, assess that the IPv6 network has failed the security audit within the detection period, and determine the reason why the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs based on the log number ratio, wherein the log number ratio is the ratio of the number of the second-level audit logs to the number of the third-level audit logs; When the level distribution is such that the number of the third-level audit logs is greater than the number of the first-level audit logs and greater than the number of the second-level audit logs, the IPv6 network is assessed to have failed the security audit within the detection period, and a compliance check is performed on the IPv6 network.

[0011] Further, the process of determining the reason why the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs based on the log number ratio includes: When the log quantity ratio is greater than a preset log quantity ratio, the IPv6 network is assessed to have a potential security risk, and a notification is issued that the data interaction security algorithm in the IPv6 network needs to be optimized; When the log quantity ratio is less than or equal to the preset log quantity ratio, it is determined that the compliance check needs to be performed on the IPv6 network.

[0012] Further, the process of performing the compliance check on the IPv6 network includes: Determine in sequence each of the activity items in the third-level audit logs that have not passed the matching comparison, and record the obtained activity items as third-level activity items; Counting the number of each of the third-level activity items, and calculating the variance of the number of each of the third-level activity items, and recording the obtained variance as the item quantity variance; When the variance of the number of items is less than or equal to the preset variance of the number of items, the IPv6 network is evaluated as failing the compliance check, and the reason for failing the compliance check is that there is a problem with the network, and a network maintenance notice is issued; When the variance of the number of items is greater than the preset variance of the number of items, the IPv6 network is evaluated as failing the compliance check, and the reason why the IPv6 network fails the compliance check is evaluated based on the number of each of the third-level active items.

[0013] Further, the process of evaluating the reasons why the compliance of the IPv6 network does not meet the standards based on the number of each of the three-level activity items includes: When the third-level activity items with the largest number are the time nodes, each of the event logs that fail to pass the matching comparison at the time nodes is recorded as a node event log; Determine the number of matches between the node event log and the third-level audit log, and record the obtained number as the node match number; Calculate the ratio of the number of node matches to the total number of node event logs, and record the obtained ratio as the node ratio; When the node ratio is greater than a preset node ratio, it is assessed that the number of event logs audited during the security audit of the IPv6 network is greater than an audit standard, and the audit cycle is optimized based on the node ratio; When the node ratio is less than or equal to the preset node ratio, the event log is evaluated to have additions or deletions, and a notification that the event log data does not meet the standards is issued.

[0014] Furthermore, the process of optimizing the audit cycle based on the node ratio includes: Calculate the difference between the node ratio and the preset node ratio, and record the calculated difference as the node ratio difference; The audit period is reduced based on the node ratio difference, and the reduction of the audit period is proportional to the log ratio difference.

[0015] Furthermore, the process of comparing the number of each of the third-level activity items to determine the third-level activity item with the largest number includes: When the largest number of active items is the terminal address or the digital signature, optimizing the firewall of the IPv6 network; Recording each of the event logs for which the terminal address and the digital signature fail the matching comparison as a marked event log; Counting the number of marked event logs in which the request result is passed in the marked event log, and recording the obtained number as the number of log passes; Calculate the ratio of the number of log passes to the total number of marked event logs, and record the obtained ratio as the marked ratio; The memory of the firewall in the IPv6 network is increased based on the tag ratio, and the increase in the memory of the firewall is proportional to the tag ratio.

[0016] Compared with the prior art, the beneficial effect of the present invention lies in that the present invention effectively realizes real-time collection of active events in the IPv6 network by periodically acquiring active events in the IPv6 network, performs security audits on each event log to generate audit logs of corresponding levels, and evaluates the IPv6 network based on the level distribution of each audit log, the evaluation includes performing security audits on the IPv6 network and performing compliance checks on the IPv6 network, effectively realizes accurate security audits and compliance checks on the IPv6 network according to active events, generates corresponding processing instructions based on the evaluation results, and re-determines the operating parameters of the corresponding components based on the received processing instructions, while effectively ensuring the operating efficiency of the system, effectively realizes targeted adjustment of the IPv6 network according to active events, and effectively improves the monitoring efficiency of the IPV6 network.

[0017] Furthermore, the present invention classifies the activity items of the event log, which can more clearly analyze each activity event in detail, is conducive to accurately generating an audit log of a corresponding level for each activity event, and further improves the monitoring efficiency for the IPV6 network.

[0018] Furthermore, the present invention matches and compares the active items in the event log with the preset active items, assesses whether a single event log has passed the security audit based on the proportion of matching items, and grades the corresponding audit logs. This can more accurately grade the audit logs corresponding to the event logs, while further realizing accurate security audits of IPv6 networks based on active events, and further improving the monitoring efficiency of IPV6 networks.

[0019] Furthermore, the present invention performs a grade evaluation on the audit log corresponding to the event log based on the request result when the proportion of matching items is less than or equal to the second preset matching item proportion and greater than the first preset matching item proportion, thereby effectively avoiding the situation where the event log and the generated audit log do not correspond when the proportion of matching items is within the above range. While further realizing accurate security audits of IPv6 networks based on active events, it further improves the monitoring efficiency of IPV6 networks.

[0020] Furthermore, the present invention evaluates the IPv6 network based on the hierarchical distribution of the number of first-level audit logs, the number of second-level audit logs, and the number of third-level audit logs, and can quickly and accurately evaluate whether the activity events obtained within the detection period have passed the security audit. While further realizing accurate security audits of IPv6 networks based on activity events, it further improves the monitoring efficiency of IPV6 networks.

[0021] Furthermore, the present invention, when the level distribution situation is that the number of secondary audit logs is greater than the number of primary audit logs and greater than the number of third-level audit logs, can timely and accurately determine the reason why the number of secondary audit logs is greater than the number of primary audit logs and greater than the number of third-level audit logs based on the log number ratio; when it is determined that the reason for failure is the existence of security risks in the IPv6 network, a notification of the need to optimize the data interaction security algorithm in the IPv6 network is issued, and the existing security risks are effectively dealt with; when it is determined that a compliance check is needed, the compliance is checked, which further realizes targeted adjustment of the IPv6 network according to activity events, and further improves the monitoring efficiency of the IPV6 network.

[0022] Furthermore, when the present invention performs compliance check on IPv6, it determines whether the compliance check has passed based on the variance of the number of items, and further realizes accurate compliance check on the IPv6 network according to active events. The compliance of the IPv6 network can be effectively and accurately assessed by utilizing the variance of the number of items, and the consistency between the active events and the assessment results is ensured. When the reason for failure of the compliance assessment is that there are problems in the network, a network maintenance notification is issued, and targeted adjustment of the IPv6 network according to active events is further realized, avoiding the occurrence of network non-compliance and standards, and further improving the monitoring efficiency of the IPV6 network.

[0023] Furthermore, the present invention evaluates the reasons why the compliance of the IPv6 network does not meet the standards based on the number of each third-level activity project. When the third-level activity project with the largest number is a time node, the node ratio is calculated, and the node ratio evaluation is used to optimize the audit cycle or issue a notification that the event log data does not meet the standards, thereby further ensuring the operating efficiency of the system and accurately evaluating the reasons why the compliance does not meet the standards. While further realizing accurate compliance checks on the IPv6 network based on activity events, the monitoring efficiency of the IPV6 network is further improved.

[0024] Furthermore, the present invention reduces the audit cycle based on the node ratio difference, further ensures the operating efficiency of the system, and effectively avoids the occurrence of the situation where the time node is the largest number of third-level activity projects due to the audit cycle not meeting the standards. While further realizing accurate security audits and compliance checks on IPv6 networks based on activity events, it further improves the monitoring efficiency of IPV6 networks.

[0025] Furthermore, the present invention increases the memory of the firewall in the IPv6 network based on the tag ratio when the largest number of active items are terminal addresses or digital signatures, thereby effectively avoiding the situation where the terminal addresses or digital signatures are the largest number of third-level active items due to the firewall's memory not meeting the standards, while further realizing targeted adjustments to the IPv6 network based on active events, and further improving the monitoring efficiency of the IPV6 network. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a structural block diagram of a security audit and compliance checking system in an IPv6 network according to an embodiment of the present invention; Figure 2 This is a flow chart of a security audit and compliance checking method in an IPv6 network according to an embodiment of the present invention; Figure 3 A flowchart of an embodiment of the present invention for performing a security audit on each event log to generate an audit log of a corresponding level; Figure 4The figure is a flow chart of evaluating an IPv6 network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0028] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0029] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0030] See also Figure 1 As shown, it is a structural block diagram of the security audit and compliance check system in the IPv6 network of the embodiment of the present invention. The structure of the embodiment of the present invention includes a data extraction unit, a data audit unit, a database, an audit analysis unit and a control unit; wherein, The data extraction unit is used to obtain activity events within a detection period in the IPv6 network; The data audit unit is connected to the data extraction unit, and is used to sequentially generate event logs of the activity events, and generate activity items corresponding to the event logs; The database is connected to the data audit unit to collect and store each preset activity item from the IPv6 network; The data audit unit is also used to perform security audit on each of the event logs to generate an audit log of a corresponding level; The audit analysis unit is connected to the data audit unit and is used to collect statistics on the level distribution of each audit log within a detection period; The audit analysis unit is also used to evaluate the IPv6 network based on the grade distribution; The audit analysis unit is also used to generate corresponding processing instructions based on the evaluation results, or to complete the periodic evaluation of the IPv6 network and evaluate the IPv6 network of the next detection cycle; wherein the evaluation includes performing a security audit on the IPv6 network and performing a compliance check on the IPv6 network; The control unit is connected to the data audit unit and the audit analysis unit respectively, and is used to redetermine the operating parameters of the corresponding components based on the received processing instructions.

[0031] See also Figure 2 As shown, it is a flow chart of a security audit and compliance checking method in an IPv6 network according to an embodiment of the present invention. The method according to the embodiment of the present invention includes: Obtain the activity event within a detection period D in the IPv6 network, wherein the period D in the embodiment of the present invention=48h; Generate each of the event logs of the activity events in sequence, and generate each of the activity items corresponding to each of the event logs; Collecting and storing each of the preset activity items from the IPv6 network; Performing security audit on each of the event logs to generate the audit log of the corresponding level; Counting the distribution of levels of the audit logs within the detection period; Assessing the IPv6 network based on the grade distribution; Generate corresponding processing instructions based on the evaluation results, or, completing the periodic assessment of the IPv6 network and assessing the IPv6 network in the next detection period; Wherein, the assessment includes conducting a security audit on the IPv6 network and conducting a compliance check on the IPv6 network; The operating parameters of the corresponding components are re-determined based on the received processing instructions.

[0032] See also Figure 3 As shown, it is a flowchart of an embodiment of the present invention performing a security audit on each event log to generate an audit log of a corresponding level. The process of the embodiment of the present invention performing a security audit on each event log to generate an audit log of a corresponding level includes: For a single activity event, the activity items in the event log of the activity event include a time node, a terminal address, a type of request information, a digital signature, and a request result; A security audit is performed on each event log based on each of the activity items in each of the event logs, and audit logs of corresponding levels of each event log are generated according to the audit results.

[0033] Please continue reading Figure 3 As shown, the process of performing security audit on each event log based on each activity item in each event log and generating each audit log of a corresponding level of each event log according to the audit result includes: Matching and comparing each of the activity items in a single event log with each of the preset activity items; When a single activity item is consistent with a single preset activity item, the activity item passes the matching comparison; Counting the number of the activity items that pass the matching comparison in a single event log, and recording the obtained number of activity items as the number of activity items; Calculate the ratio of the number of the activity items to the total number of the activity items, and record the obtained ratio as the matching item ratio; Performing a grade evaluation on the audit log corresponding to a single event log based on the proportion of matching items; When the proportion of the matching items is greater than the second preset matching item proportion R2, the single event log is evaluated to have passed the security audit, and the corresponding audit log is recorded as a first-level audit log, wherein the second preset matching item proportion R2 in this embodiment is 79%; When the matching item ratio is less than or equal to the second preset matching item ratio R2 and greater than the first preset matching item ratio R1, the audit log corresponding to the event log is graded based on the request result, wherein the first preset matching item ratio R1 in this embodiment is 20%; When the matching item ratio is less than or equal to the first preset matching item ratio R1, the single event log is evaluated as failing the security audit, and the corresponding audit log is recorded as a level 3 audit log; The level evaluation of each audit log corresponding to each event log is completed in sequence.

[0034] Please continue reading Figure 3 As shown, the process of performing the level evaluation on the audit log corresponding to the event log based on the request result in the embodiment of the present invention includes: Obtaining a request result for the activity event corresponding to a single event log; When the request result is rejected, the single event log is evaluated as having passed the security audit, and the corresponding audit log is recorded as a secondary audit log; When the request result is passed, the single event log is evaluated as failing the security audit, and the corresponding audit log is recorded as a level 3 audit log.

[0035] See also Figure 4As shown, it is a flow chart of an embodiment of the present invention for evaluating an IPv6 network. The process of evaluating the IPv6 network based on the level distribution in the embodiment of the present invention includes: Counting the number of the first-level audit log, the second-level audit log, and the third-level audit log respectively, and determining the level distribution of each audit log; When the level distribution is that the number of the first-level audit logs is greater than the number of the second-level audit logs and greater than the number of the third-level audit logs, assess that the IPv6 network has passed the security audit within the detection period, and assess the security audit of the IPv6 network in the next detection period; When the level distribution is that the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs, assess that the IPv6 network has failed the security audit within the detection period, and determine the reason why the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs based on the log number ratio, wherein the log number ratio is the ratio of the number of the second-level audit logs to the number of the third-level audit logs; When the level distribution is such that the number of the third-level audit logs is greater than the number of the first-level audit logs and greater than the number of the second-level audit logs, the IPv6 network is assessed to have failed the security audit within the detection period, and a compliance check is performed on the IPv6 network.

[0036] Please continue reading Figure 4 As shown, the process of determining the reason why the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs based on the log number ratio in the embodiment of the present invention includes: When the log quantity ratio is greater than a preset log quantity ratio A, it is assessed that the IPv6 network has a security risk, and a notification is issued that the data interaction security algorithm in the IPv6 network needs to be optimized, wherein the preset log quantity ratio A in the embodiment of the present invention is 1.5; Specifically, when optimizing the data interaction security algorithm in the IPv6 network, vulnerability scanning and risk analysis are performed on the network system, etc., the risks that may be caused by various security risks are evaluated, potential attack paths and the possibility of data leakage are considered, etc., specific security goals are determined based on the relevant risk assessment results, the risk of data leakage is reduced to the target ratio, the data interaction security algorithm is improved in combination with network characteristics and security requirements, the security algorithm is integrated into the network system and application, the compatibility and stability of the security algorithm and the system are ensured, and the system integrating the new security algorithm is comprehensively functionally tested, simulated attack tests are performed, etc., to verify whether the optimized system can resist various network attacks; When the log quantity ratio is less than or equal to the preset log quantity ratio A, it is determined that the compliance check needs to be performed on the IPv6 network.

[0037] Please continue reading Figure 4 As shown, the process of performing the compliance check on the IPv6 network in the embodiment of the present invention includes: Determine in sequence each of the activity items in the third-level audit logs that have not passed the matching comparison, and record the obtained activity items as third-level activity items; Counting the number of each of the third-level activity items, and calculating the variance of the number of each of the third-level activity items, and recording the obtained variance as the item quantity variance; When the item quantity variance is less than or equal to the preset item quantity variance C, it is determined that the IPv6 network has failed the compliance check, and the reason for the compliance failure is that there is a problem with the network, and a network maintenance notification is issued, wherein the preset item quantity variance C=0.32 in the embodiment of the present invention; When the item quantity variance is greater than the preset item quantity variance C, the IPv6 network is evaluated as failing the compliance check, and the reason why the IPv6 network fails the compliance check is evaluated based on the quantity of each of the third-level active items.

[0038] Please continue reading Figure 4 As shown, the process of evaluating the reasons why the compliance of the IPv6 network does not meet the standards based on the number of each of the three-level activity items in the embodiment of the present invention includes: Comparing the number of each of the three-level activity items to determine the third-level activity item with the largest number; When the third-level activity items with the largest number are the time nodes, each of the event logs that fail to pass the matching comparison at the time nodes is recorded as a node event log; Determine the number of matches between the node event log and the third-level audit log, and record the obtained number as the node match number; Calculate the ratio of the number of node matches to the total number of node event logs, and record the obtained ratio as the node ratio; When the node ratio is greater than a preset node ratio N, it is assessed that the number of event logs audited during the security audit of the IPv6 network is greater than the audit standard, and the audit cycle is optimized based on the node ratio, wherein the embodiment of the present invention presets the node ratio N=72.8%; When the node ratio is less than or equal to the preset node ratio N, it is assessed that there is addition or deletion in the event log, and a notification that the event log data does not meet the standards is issued.

[0039] Please continue reading Figure 4As shown, the process of optimizing the audit cycle based on the node ratio in the embodiment of the present invention includes: Calculate the difference between the node ratio and the preset node ratio, and record the calculated difference as the node ratio difference; reducing the audit period based on the node ratio difference; When the node ratio difference is greater than the second preset node ratio difference F2, the audit period is reduced to 0.88 times of the initial audit period, wherein the second preset node ratio difference F2 in the embodiment of the present invention is 21.3%; When the node ratio difference is less than or equal to the second preset node ratio difference F2 and greater than the first preset node ratio difference F1, the audit period is reduced to 0.91 times of the initial audit period, wherein the first preset node ratio difference F1 in the embodiment of the present invention is 12.9%; When the node ratio difference is less than or equal to the first preset node ratio difference F1, the audit period is reduced to 0.95 times of the initial audit period.

[0040] Please continue reading Figure 4 As shown, the process of comparing the number of each of the third-level activity items to determine the third-level activity item with the largest number in the embodiment of the present invention includes: When the largest number of active items is the terminal address or the digital signature, optimizing the firewall of the IPv6 network; Recording each of the event logs for which the terminal address and the digital signature fail the matching comparison as a marked event log; Counting the number of marked event logs in which the request result is passed in the marked event log, and recording the obtained number as the number of log passes; Calculate the ratio of the number of log passes to the total number of marked event logs, and record the obtained ratio as the marked ratio; Increasing the memory of the firewall in the IPv6 network based on the tag ratio; When the tag ratio is greater than a second preset tag ratio M2, the memory of the firewall is increased to 1.23 times the memory of the initial firewall, wherein the second preset tag ratio M2 in the embodiment of the present invention is 52%; When the tag ratio is less than or equal to the second preset tag ratio M2 and greater than the first preset tag ratio M1, the memory of the firewall is increased to 1.16 times the memory of the initial firewall, wherein the first preset tag ratio M1 in the embodiment of the present invention is 33%; When the mark ratio is less than or equal to the first preset mark ratio M1, the memory of the firewall is increased to 1.08 times the memory of the initial firewall.

[0041] Embodiment 1: Acquire 21 activity events within the 48h detection cycle in the IPv6 network, and generate event logs for each activity event in turn. For a single activity event, its event log includes the time node, terminal address, type of request information, digital signature and request result. The time node, terminal address, type of request information, digital signature and request result of each event log are matched and compared with each preset event log, and a security audit is performed on each event log to generate an audit log of the corresponding level.

[0042] For a single activity event, each activity item in a single event log is matched and compared with each preset activity item. When a single activity item is consistent with a single preset activity item, the activity item passes the matching and comparison. The number of matched activity items is 5. The ratio of the number of activity items 5 to the total number of activity items 5 is calculated. When the matching item ratio is 100% and is greater than the second preset matching item ratio of 79%, the event log is evaluated to have passed the security audit, and the audit log corresponding to the activity event is recorded as a first-level audit log. For a single activity event, the number of matched activity items is 3. The ratio of the number of activity items 3 to the total number of activity items 5 is calculated. The matching item ratio is 60%, which is less than or equal to the second preset matching item ratio of 79% and greater than the first preset matching item ratio. The matching items account for 20%. Based on the request result, the audit log corresponding to the event log is graded. When the request result is rejected, the single event log is evaluated as having passed the security audit, and the corresponding audit log is recorded as a secondary audit log. When the request result is passed, the single event log is evaluated as having failed the security audit, and the corresponding audit log is recorded as a tertiary audit log. For a single active event, the number of matching active items is 1, and the ratio of the number of active items 1 to the total number of active items 5 is calculated. The matching items account for 20%, which is less than or equal to the first preset matching items account for 20%. The single event log is evaluated as having failed the security audit, and the corresponding audit log is recorded as a tertiary audit log. The grade evaluation of each audit log corresponding to each event log is completed in turn.

[0043] According to the statistics, the number of first-level audit logs is 18, the number of second-level audit logs is 2, and the number of third-level audit logs is 1. The IPv6 network is assessed to have passed the security audit within the detection period, and the security audit of the IPv6 network in the next detection period will be assessed.

[0044] Embodiment 2: 23 activity events within a detection period of 48 hours in the IPv6 network are obtained, and the level evaluation of each activity event is completed in turn. The level evaluation process is the same as that in Example 1. The number of secondary audit logs is 13, the number of primary audit logs is 2, and the number of tertiary audit logs is 8. It is assessed that the IPv6 network has failed the security audit within the detection period, and the reason for the failure of the security audit of the IPv6 network is determined based on the log number ratio. The ratio of the number of secondary logs, 13, to the number of tertiary logs, 8, is 1.625, which is greater than the preset log number ratio of 1.5. It is assessed that there are security risks in the IPv6 network, and a notification is issued that the data interaction security algorithm in the IPv6 network needs to be optimized.

[0045] Embodiment 3: 22 activity events within a detection period of 48 hours in the IPv6 network are obtained, and the level evaluation of each activity event is completed in turn. The level evaluation process is the same as that of the embodiment 1. The number of third-level audit logs is 12, the number of first-level audit logs is 9, and the number of second-level audit logs is 1. The IPv6 network is evaluated as failing the security audit within the detection period. The IPv6 network is checked for compliance, and each activity item that fails the matching comparison in each third-level audit log is determined in turn, and the obtained activity items are recorded as third-level activity items. The number of each third-level activity item is counted, the number of time nodes is 5, the number of terminal addresses is 2, the number of types of request information is 1, the number of digital signatures is 2, and the number of request results is 2. The variance of the number of each third-level activity item is calculated to be 2.3, which is greater than the preset variance of the number of items 0.3 2. Assess that the IPv6 network has failed the compliance check, assess the reasons for the failure of the IPv6 network compliance based on the number of each third-level activity item, determine the third-level activity item with the largest number as the time node, record each event log that has not passed the matching comparison at the time node as the node event log, determine the number of node matches 4 that match the node event log 5 with the third-level audit log 12, calculate the node ratio of the node match number 4 to the total number of node event logs 5 to be 80%, which is greater than the preset node ratio of 72.8%, assess that the number of event logs audited during the security audit is greater than the audit standard, and optimize the audit cycle based on the node ratio, calculate the difference between the node ratio of 80% and the preset node ratio of 72.8% to be 7.2%, which is less than or equal to the first preset node ratio difference of 12.9%, and reduce the audit cycle to 0.95 times the initial audit cycle.

[0046] Embodiment 4: Obtain 20 activity events within a detection period of 48h in the IPv6 network, and complete the level evaluation of each activity event in turn. The level evaluation process is the same as that in Example 1. The number of third-level audit logs is 11, the number of first-level audit logs is 8, and the number of second-level audit logs is 1. It is assessed that the IPv6 network has not passed the security audit within the detection period. The IPv6 network is checked for compliance, and each activity item that has not passed the matching comparison in each third-level audit log is determined in turn, and the obtained activity items are recorded as third-level activity items. The number of each third-level activity item is counted, the number of time nodes is 1, the number of terminal addresses is 6, the number of types of request information is 2, the number of digital signatures is 1, and the number of request results is 1. Calculate each The variance of the number of level 3 active items is 4.7, which is greater than the variance of the preset number of items 0.32. The IPv6 network is assessed to have failed the compliance check. The reasons for the failure of the IPv6 network compliance are assessed based on the number of each level 3 active item. It is determined that the level 3 active item with the largest number is the terminal address. The firewall of the IPv6 network is optimized, and each event log in which the terminal address fails the matching comparison is recorded as a marked event log. The number of marked event logs with a request result of passed in the marked event log is counted as 5. The marking ratio of the number of log passes 5 to the total number of marked event logs 6 is calculated to be 83.33%, which is greater than the second preset marking ratio of 52%. The memory of the firewall is increased to 1.23 times the memory of the initial firewall.

[0047] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0048] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security audit and compliance checking method in an IPv6 network, characterized in that: include: Obtaining activity events within a detection period in the IPv6 network; Generate event logs for the activity events in sequence, and generate activity items corresponding to the event logs; Collecting and storing each preset activity item from the IPv6 network; Performing a security audit on each of the event logs to generate an audit log of a corresponding level; Counting the distribution of levels of the audit logs within the detection period; Assessing the IPv6 network based on the grade distribution; Generate corresponding processing instructions based on the evaluation results, or, completing the periodic assessment of the IPv6 network and assessing the IPv6 network in the next detection period; Wherein, the assessment includes conducting a security audit on the IPv6 network and conducting a compliance check on the IPv6 network; The operating parameters of the corresponding components are re-determined based on the received processing instructions.

2. The method for security audit and compliance checking in an IPv6 network according to claim 1, characterized in that: The process of performing security audit on each of the event logs to generate the audit log of the corresponding level includes: For a single activity event, the activity items in the event log of the activity event include a time node, a terminal address, a type of request information, a digital signature, and a request result; A security audit is performed on each event log based on each of the activity items in each of the event logs, and audit logs of corresponding levels of each event log are generated according to the audit results.

3. The method for security audit and compliance checking in an IPv6 network according to claim 2, characterized in that: The process of performing security audit on each event log based on each activity item in each event log, and generating each audit log of a corresponding level of each event log according to the audit result includes: Matching and comparing each of the activity items in a single event log with each of the preset activity items; When a single activity item is consistent with a single preset activity item, the activity item passes the matching comparison; Counting the number of the activity items that pass the matching comparison in a single event log, and recording the obtained number of activity items as the number of activity items; Calculate the ratio of the number of the activity items to the total number of the activity items, and record the obtained ratio as the matching item ratio; When the proportion of the matching items is greater than the proportion of the second preset matching items, the single event log is evaluated to have passed the security audit, and the corresponding audit log is recorded as a first-level audit log; When the matching item ratio is less than or equal to the second preset matching item ratio and greater than the first preset matching item ratio, performing a level evaluation on the audit log corresponding to the event log based on the request result; When the proportion of the matching items is less than or equal to the first preset proportion of the matching items, the single event log is evaluated as failing the security audit, and the corresponding audit log is recorded as a level 3 audit log; The level evaluation of each audit log corresponding to each event log is completed in sequence.

4. The method for security audit and compliance checking in an IPv6 network according to claim 3, characterized in that: The process of performing the level evaluation on the audit log corresponding to the event log based on the request result includes: Obtaining a request result for the activity event corresponding to a single event log; When the request result is rejected, the single event log is evaluated as having passed the security audit, and the corresponding audit log is recorded as a secondary audit log; When the request result is passed, the single event log is evaluated as failing the security audit, and the corresponding audit log is recorded as a level 3 audit log.

5. The method for security audit and compliance checking in an IPv6 network according to claim 4, characterized in that: The process of evaluating the IPv6 network based on the grade distribution includes: When the level distribution is that the number of the first-level audit logs is greater than the number of the second-level audit logs and greater than the number of the third-level audit logs, assess that the IPv6 network has passed the security audit during the detection period, and assess the security audit of the IPv6 network in the next detection period; When the level distribution is that the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs, assess that the IPv6 network has failed the security audit within the detection period, and determine the reason why the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs based on the log number ratio, wherein the log number ratio is the ratio of the number of the second-level audit logs to the number of the third-level audit logs; When the level distribution is such that the number of the third-level audit logs is greater than the number of the first-level audit logs and greater than the number of the second-level audit logs, the IPv6 network is assessed to have failed the security audit within the detection period, and a compliance check is performed on the IPv6 network.

6. The method for security audit and compliance checking in an IPv6 network according to claim 5, characterized in that: The process of determining the reason why the number of the second-level audit logs is greater than the number of the first-level audit logs and greater than the number of the third-level audit logs based on the log number ratio includes: When the log quantity ratio is greater than a preset log quantity ratio, the IPv6 network is assessed to have a potential security risk, and a notification is issued that the data interaction security algorithm in the IPv6 network needs to be optimized; When the log quantity ratio is less than or equal to the preset log quantity ratio, it is determined that the compliance check needs to be performed on the IPv6 network.

7. The method for security audit and compliance checking in an IPv6 network according to claim 6, characterized in that: The process of performing the compliance check on the IPv6 network includes: Determine in sequence each of the activity items in the third-level audit logs that have not passed the matching comparison, and record the obtained activity items as third-level activity items; Counting the number of each of the third-level activity items, and calculating the variance of the number of each of the third-level activity items, and recording the obtained variance as the item quantity variance; When the variance of the number of items is less than or equal to the preset variance of the number of items, the IPv6 network is evaluated as failing the compliance check, and the reason for failing the compliance check is that there is a problem with the network, and a network maintenance notice is issued; When the variance of the number of items is greater than the preset variance of the number of items, the IPv6 network is evaluated as failing the compliance check, and the reason why the IPv6 network fails the compliance check is evaluated based on the number of each of the third-level active items.

8. The method for security audit and compliance checking in an IPv6 network according to claim 7, characterized in that: The process of evaluating the reasons why the compliance of the IPv6 network does not meet the standards based on the number of each of the three-level activity items includes: When the third-level activity items with the largest number are the time nodes, each of the event logs that fail to pass the matching comparison at the time nodes is recorded as a node event log; Determine the number of matches between the node event log and the third-level audit log, and record the obtained number as the node match number; Calculate the ratio of the number of node matches to the total number of node event logs, and record the obtained ratio as the node ratio; When the node ratio is greater than a preset node ratio, it is assessed that the number of event logs audited during the security audit of the IPv6 network is greater than an audit standard, and the audit cycle is optimized based on the node ratio; When the node ratio is less than or equal to the preset node ratio, the event log is evaluated to have additions or deletions, and a notification that the event log data does not meet the standards is issued.

9. The method for security audit and compliance checking in an IPv6 network according to claim 8, characterized in that: The process of optimizing the audit cycle based on the node ratio includes: Calculate the difference between the node ratio and the preset node ratio, and record the difference as the node ratio difference; The audit period is reduced based on the node ratio difference, and the reduction of the audit period is proportional to the log ratio difference.

10. The method for security audit and compliance checking in an IPv6 network according to claim 8, characterized in that: The process of comparing the number of each of the three-level activity items to determine the largest number of three-level activity items includes: When the largest number of active items is the terminal address or the digital signature, optimizing the firewall of the IPv6 network; Recording each of the event logs for which the terminal address and the digital signature fail the matching comparison as a marked event log; Counting the number of marked event logs in which the request result is passed in the marked event log, and recording the obtained number as the number of log passes; Calculate the ratio of the number of log passes to the total number of marked event logs, and record the obtained ratio as the marked ratio; The memory of the firewall in the IPv6 network is increased based on the tag ratio, and the increase in the memory of the firewall is proportional to the tag ratio.

Images