Computer network security monitoring method and system

Abstract

The invention discloses a computer network security monitoring method. The method comprises the following steps: S1, data acquisition and extraction; s2, data analysis and clustering; s3, identifying and classifying potential threats; s4, dynamic monitoring and early warning are carried out; s5, an automatic response mechanism; s6, abnormal traffic analysis and identification; and S7, analyzing and optimizing. According to the invention, through feature extraction, deep clustering analysis, abnormal traffic identification, danger level endowing and automatic response strategy generation of network traffic, comprehensive monitoring and response to network security threats are realized; the flow classification accuracy is effectively improved, resources can be more accurately concentrated in real threats, the false alarm rate is reduced, the known attack can be quickly identified, unknown attack behaviors can be deduced and analyzed through deep analysis, and the flow classification efficiency is improved. The double protection means greatly improves the protection capability of the system to complex and diversified attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a computer network security monitoring method and system. Background Art

[0002] With the rapid development of the Internet, computer networks have become an important part of people's daily life and work. However, security threats in the network environment are becoming increasingly severe. Various malicious attacks, network intrusions, data leaks and other security incidents occur frequently, bringing huge risks and losses to enterprises, governments and individuals. Therefore, the research on network security monitoring and protection technology has become a core topic in the field of information security. Traditional network security monitoring methods mainly rely on static rule detection methods such as firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS). However, with the continuous upgrading and complexity of attack technologies, static rule-based detection methods are difficult to cope with dynamic and complex network threats. For example, new attack methods such as advanced persistent threats (APT), distributed denial of service (DDoS) attacks, and zero-day vulnerability attacks can bypass traditional protection measures, resulting in the inability of security monitoring systems to effectively identify and respond to these attacks. Summary of the invention

[0003] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0005] In a first aspect, an embodiment of the present invention provides a computer network security monitoring method, comprising:

[0006] S1. Data collection and extraction: The traffic data in the target network is captured in real time through the network traffic monitor, and the captured raw traffic data is subjected to feature extraction to extract the key features of the traffic;

[0007] S2. Data analysis and clustering: Use deep clustering algorithms to perform cluster analysis on network traffic and automatically divide it into normal traffic, suspicious traffic, and abnormal traffic;

[0008] S3, potential threat identification and classification: clustering results are classified, and normal traffic, suspicious traffic and abnormal traffic are automatically divided into different clusters;

[0009] S4, Dynamic monitoring and early warning: Dynamically monitor the identified suspicious and abnormal traffic, and send real-time early warning notifications to the administrator;

[0010] S5, Automated response mechanism: Assign a danger level to each traffic flow, automatically determine its severity, and generate an automatic response strategy;

[0011] S6. Abnormal traffic analysis and identification: Use the attack feature library to further analyze and compare the identified abnormal traffic to identify whether there is a specific attack behavior;

[0012] S7. Analysis and optimization: The system records the results of each cluster analysis and threat detection and saves the logs for administrators to conduct post-audit.

[0013] As a preferred solution of the computer network security monitoring method described in the present invention, the specific formula of the deep clustering algorithm is as follows:

[0014]

[0015] Where K is the total number of clusters, indicating how many categories it is divided into; f k (X) represents the feature aggregation function for the kth cluster.

[0016] As a preferred solution of the computer network security monitoring method described in the present invention, wherein: k (X) The specific calculation formula is as follows:

[0017]

[0018] Where N is the total number of data points, indicating the sample size of the entire data set; D is the total number of feature dimensions for each data point.

[0019] As a preferred solution of the computer network security monitoring method described in the present invention, wherein: k (X)g(x ij , μ kj , σ kj )The specific calculation formula is as follows:

[0020]

[0021] where x ij is the value of the i-th traffic data point on the j-th feature dimension; μ kj is the mean of the kth cluster on the jth feature dimension; σ kj is the standard deviation of the cluster on the jth feature dimension.

[0022] As a preferred solution of the computer network security monitoring method described in the present invention, the specific value range of the deep clustering algorithm C is as follows:

[0023] 0≤C<0.2, first-level excellent clustering, the data points are basically very close to the cluster center, which belongs to normal traffic;

[0024] 0.2≤C<0.4, good secondary clustering, data points are close to the cluster center, which is normal traffic;

[0025] 0.4≤C<0.6, third-level medium clustering, the distance between the data point and the cluster center is moderate, the clustering effect is average, there may be potential threats, it is suspicious traffic, and further monitoring and analysis are required;

[0026] 0.6≤C<0.8, four-level poor clustering, the distance between the data point and the cluster center is large, the clustering effect is poor, this type of traffic is abnormal traffic, and further safety measures need to be taken immediately;

[0027] 0.8≤C<1, five-level extreme difference clustering, the data points and the cluster center are very scattered, the clustering effect is very poor, this type of traffic is abnormal traffic, and further safety measures must be taken immediately.

[0028] As a preferred solution of the computer network security monitoring method described in the present invention, the suspicious traffic level and response strategy are as follows:

[0029] Level 1 Excellent Cluster: Low risk, normal traffic, continue to monitor records;

[0030] Level 2 good clustering: medium-low risk, normal traffic, slight anomalies, continue to monitor records;

[0031] Level 3 medium clustering: medium risk, suspicious traffic partially matches attack characteristics, may be in the early stage of attack, need to be isolated, replay traffic and issue a warning;

[0032] Level 4 poor clustering: high risk, abnormal traffic, obvious attack characteristics, automatic blocking, activation of the intrusion prevention system and alarm notification to management personnel;

[0033] Level 5 extreme clustering: severe risk, abnormal traffic, obvious attack behavior, serious damage has been caused, the entire network is isolated, emergency response and alarm notification to management personnel.

[0034] As a preferred solution of the computer network security monitoring method described in the present invention, the analysis and comparison of the abnormal traffic and the attack feature library includes:

[0035] Rule-based matching: Use the rule engine to compare the characteristics of abnormal traffic with the rules in the attack library one by one;

[0036] Signature-based matching: Compare the characteristics of abnormal traffic with known signatures in the attack library, and find malicious attack signatures through deep detection of traffic packets;

[0037] Similarity-based matching: Matching is performed by calculating the similarity between abnormal traffic and attack behaviors in the attack signature library. The specific formula is as follows: Among them, A is the abnormal traffic feature set, and B is the supply feature set in the attack feature library.

[0038] In a second aspect, an embodiment of the present invention provides a computer network security monitoring system, specifically comprising:

[0039] Data acquisition module: including network traffic monitoring unit, data feature extraction unit and data caching and preprocessing unit;

[0040] Data analysis module: including deep clustering unit and grade evaluation unit;

[0041] Hazard identification and classification module: including classification unit and flow characteristic marking unit;

[0042] Dynamic monitoring and early warning module: including real-time monitoring unit, early warning notification unit and suspicious traffic tracking unit;

[0043] Automatic response module: including danger level assessment unit, response strategy generation unit and automatic defense unit;

[0044] Abnormal traffic analysis module: including attack feature library unit, attack feature library update unit, feature matching unit and attack identification unit;

[0045] Analysis and optimization module: includes log recording unit, audit report generation unit and model feedback optimization unit.

[0046] In a third aspect, an embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of a computer network security monitoring method as described in the first aspect of the present invention is implemented.

[0047] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of a computer network security monitoring method as described in the first aspect of the present invention is implemented.

[0048] Beneficial effects of the present invention:

[0049] Through the feature extraction of network traffic, deep cluster analysis, abnormal traffic identification, danger level assignment and automatic response strategy generation, comprehensive monitoring and response to network security threats are achieved; the accuracy of traffic classification is effectively improved, and resources can be more accurately focused on real threats, reducing false alarm rates. Through automated response strategies, effective responses can be ensured as soon as network attacks occur; the automation of response mechanisms improves the system's emergency response capabilities and overall security; through attack feature library comparison, the present invention can quickly identify known attacks, and through deep analysis, it can also infer and analyze unknown attack behaviors. This dual protection method greatly improves the system's protection capabilities against complex and diverse attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0051] Figure 1 A method flow chart of a computer network security monitoring method proposed by the present invention;

[0052] Figure 2 This is a system architecture diagram of a computer network security monitoring system proposed by the present invention. DETAILED DESCRIPTION

[0053] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0054] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0055] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0056] Reference Figure 1-2 The present invention provides a computer network security monitoring method, comprising:

[0057] S1. Data collection and extraction: The traffic data in the target network is captured in real time through the network traffic monitor, including the source IP address, destination IP address, port number, protocol type, traffic size, timestamp and other multi-dimensional information of the data packet. The captured raw traffic data is subjected to feature extraction to extract the key features of the traffic, including traffic time interval, packet size distribution, connection duration, etc., for subsequent cluster analysis;

[0058] S2. Data analysis and clustering: Use deep clustering algorithms to perform cluster analysis on network traffic and automatically divide it into normal traffic, suspicious traffic, and abnormal traffic;

[0059] S3, potential threat identification and classification: clustering results are classified, and normal traffic, suspicious traffic and abnormal traffic are automatically divided into different clusters;

[0060] S4, Dynamic monitoring and early warning: Dynamically monitor the identified suspicious and abnormal traffic, and send real-time early warning notifications to administrators, providing detailed information on suspicious traffic, including source IP, destination IP, traffic characteristics, etc., to provide decision support for managers;

[0061] S5, Automated response mechanism: Assign a danger level to each traffic flow, automatically determine its severity, and generate an automatic response strategy;

[0062] S6. Abnormal traffic analysis and identification: Use the attack feature library to further analyze and compare the identified abnormal traffic to identify whether there is a specific attack behavior, match it with the predefined attack features, confirm the attack behavior and provide it to the staff;

[0063] S7. Analysis and optimization: The system records the results of each cluster analysis and threat detection and saves logs for administrators to conduct post-audit. Based on these log data, the system can further optimize the clustering model and improve the accuracy of future detection.

[0064] Among them, the specific formula of the deep clustering algorithm is as follows:

[0065]

[0066] Where K is the total number of clusters, indicating how many categories it is divided into; f k (X) represents the feature aggregation function for the kth cluster. The value range of C is between [0,1], which represents the accuracy of the clustering result. A value close to 0 means that the data point is very close to the cluster center, and a value close to 1 means that the data point is far away from the cluster center and the clustering effect is poor.

[0067] Furthermore, f k (X) The specific calculation formula is as follows:

[0068]

[0069] Where N is the total number of data points, indicating the sample size of the entire data set; D is the total number of feature dimensions for each data point.

[0070] Furthermore, f k (X)g(x ij , μ kj , σ kj )The specific calculation formula is as follows:

[0071]

[0072] where x ij is the value of the i-th traffic data point on the j-th feature dimension; μ kj is the mean of the kth cluster on the jth feature dimension; σ kj is the standard deviation of the cluster in the jth feature dimension, which is used to measure the dispersion of the cluster.

[0073] Furthermore, the specific value range of the deep clustering algorithm C is as follows:

[0074] 0≤C<0.2, first-level excellent clustering, the data points are basically very close to the cluster center, the clustering effect is very good, the data is highly concentrated, and almost no points deviate from the center, which is in line with system expectations and belongs to normal traffic;

[0075] 0.2≤C<0.4, good secondary clustering, data points are close to the cluster center, the clustering effect is good, most data points are near the cluster center, a small number of points deviate, which is in line with system expectations and belongs to normal traffic;

[0076] 0.4≤C<0.6, third-level medium clustering, the distance between the data point and the cluster center is moderate, the clustering effect is average, there are more data points distributed far away from the cluster center, but there is still a certain clustering structure, there may be potential threats, it is suspicious traffic, and further monitoring and analysis are required;

[0077] 0.6≤C<0.8, four-level poor clustering, the distance between the data point and the cluster center is large, the clustering effect is poor, the data points are scattered, and the representativeness of the cluster center is weak. The behavior of these flows is abnormal. This type of flow is abnormal and further security measures need to be taken immediately;

[0078] 0.8≤C<1, five-level extreme difference clustering, the data points and the cluster centers are very scattered, the clustering effect is very poor, the data has almost no obvious clustering structure, the center point is not representative, the behavior of these flows is abnormal, this type of flow is abnormal, and further safety measures must be taken immediately.

[0079] Furthermore, the suspicious traffic levels and response strategies are as follows:

[0080] Level 1 Excellent Cluster: Low risk, normal traffic, continue to monitor records;

[0081] Level 2 good clustering: medium-low risk, normal traffic, slight anomalies, continue to monitor records;

[0082] Level 3 medium clustering: medium risk, suspicious traffic partially matches attack characteristics, may be in the early stage of attack, need to be isolated, replay traffic and issue a warning;

[0083] Level 4 poor clustering: high risk, abnormal traffic, obvious attack characteristics, automatic blocking, activation of the intrusion prevention system and alarm notification to management personnel;

[0084] Five-level extreme difference clustering: serious risk, abnormal traffic, obvious attack behavior, serious damage has been caused, the entire network is isolated, emergency response and alarm notification to management personnel. By dividing the risk level of each traffic and formulating corresponding response strategies, the network security monitoring system can respond to potential threats quickly and effectively. The system can automatically determine the risk level, take measures such as speed limit, isolation, blocking, and notify the administrator or security team for further disposal.

[0085] Further, the analysis and comparison of abnormal traffic and attack signature library include:

[0086] Rule-based matching: Use the rule engine to compare the characteristics of abnormal traffic with the rules in the attack library one by one. For example, if certain attack behaviors trigger specific patterns (such as a large number of SYN packets), the rule engine can be used for pattern matching.

[0087] Signature-based matching: Compare the characteristics of abnormal traffic with known signatures in the attack library, and find malicious attack signatures through deep inspection (DPI) of traffic packets. The signature library stores specific data packet signatures such as SQL injection attacks and cross-site scripting attacks.

[0088] Similarity-based matching: Matching is performed by calculating the similarity between abnormal traffic and attack behaviors in the attack signature library. The specific formula is as follows: A is the abnormal traffic feature set, and B is the supplied feature set in the attack feature library. The attack behavior is confirmed by comparing the detected abnormal traffic with the attack behavior in the attack feature library.

[0089] This embodiment also provides a computer network security monitoring system, which specifically includes:

[0090] Data acquisition module: including network traffic monitoring unit, data feature extraction unit and data cache and preprocessing unit, responsible for real-time capture of traffic data in the target network and feature extraction;

[0091] Data analysis module: including deep clustering unit and grade evaluation unit, which uses deep clustering algorithm to perform cluster analysis on traffic data and automatically divide normal traffic into abnormal traffic;

[0092] Danger identification and classification module: including a classification unit and a flow feature marking unit. The classification unit classifies the clustering results, and the flow feature marking unit marks normal flow and abnormal flow according to the classification results.

[0093] Dynamic monitoring and warning module: including real-time monitoring unit, warning notification unit and suspicious traffic tracking unit, which monitors suspicious traffic in real time and sends alarm notifications to administrators;

[0094] Automatic response module: including the danger level assessment unit, response strategy generation unit and automatic defense unit, which automatically assigns danger levels to each suspicious traffic and generates corresponding response strategies according to its characteristics and behaviors;

[0095] Abnormal traffic analysis module: including attack feature library unit, attack feature library update unit, feature matching unit and attack identification unit, which compares abnormal traffic with the attack feature library to identify whether there is known attack behavior;

[0096] Analysis and optimization module: includes log recording unit, audit report generation unit and model feedback optimization unit, which records the results of each cluster analysis and threat detection for administrators to conduct post-audit and optimization.

[0097] This embodiment also provides a computer device, which is applicable to a computer network security monitoring method, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement a computer network security monitoring method proposed in the above embodiment.

[0098] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0099] The present embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, a computer network security monitoring method as proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0100] In summary, the present invention realizes comprehensive monitoring and response to network security threats through feature extraction, deep cluster analysis, abnormal traffic identification, danger level assignment and automatic response strategy generation of network traffic; it effectively improves the accuracy of traffic classification, can more accurately focus resources on real threats, and reduce false alarm rates. Through automated response strategies, it is ensured that effective responses can be made as soon as network attacks occur; the automation of response mechanisms improves the system's emergency handling capabilities and improves overall security; through attack feature library comparison, the present invention can realize rapid identification of known attacks, and through deep analysis, it can also infer and analyze unknown attack behaviors. This dual protection method greatly improves the system's protection capabilities against complex and diversified attacks.

[0101] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A computer network security monitoring method, characterized in that: include: S1. Data collection and extraction: The traffic data in the target network is captured in real time through the network traffic monitor, and the captured raw traffic data is subjected to feature extraction to extract the key features of the traffic; S2. Data analysis and clustering: Use deep clustering algorithms to perform cluster analysis on network traffic and automatically divide it into normal traffic, suspicious traffic and abnormal traffic; S3, potential threat identification and classification: the clustering results are classified, and normal traffic, suspicious traffic and abnormal traffic are automatically divided into different clusters; S4, Dynamic monitoring and early warning: Dynamically monitor the identified suspicious and abnormal traffic, and send real-time early warning notifications to the administrator; S5, Automated response mechanism: Assign a danger level to each traffic flow, automatically determine its severity, and generate an automatic response strategy; S6. Abnormal traffic analysis and identification: Use the attack feature library to further analyze and compare the identified abnormal traffic to identify whether there is a specific attack behavior; S7. Analysis and optimization: The system records the results of each cluster analysis and threat detection and saves the logs for administrators to conduct post-audit.

2. A computer network security monitoring method according to claim 1, characterized in that: The specific formula of the deep clustering algorithm is as follows: Where K is the total number of clusters, indicating how many categories it is divided into; f k (X) represents the feature aggregation function for the kth cluster.

3. A computer network security monitoring method according to claim 2, characterized in that: The f k (X) The specific calculation formula is as follows: Where N is the total number of data points, indicating the sample size of the entire data set; D is the total number of feature dimensions for each data point.

4. A computer network security monitoring method according to claim 3, characterized in that: The f k (X)g(x ij , μ kj , σ kj )The specific calculation formula is as follows: where x ij is the value of the i-th traffic data point on the j-th feature dimension; μ kj is the mean of the kth cluster on the jth feature dimension; σ kj is the standard deviation of the cluster on the jth feature dimension.

5. A computer network security monitoring method according to claim 4, characterized in that: The specific value range of the deep clustering algorithm C is as follows: 0≤C<0.2, first-level excellent clustering, the data points are basically very close to the cluster center, which belongs to normal traffic; 0.2≤C<0.4, good secondary clustering, data points are close to the cluster center, which is normal traffic; 0.4≤C<0.6, third-level medium clustering, the distance between the data point and the cluster center is moderate, the clustering effect is average, there may be potential threats, it is suspicious traffic, and further monitoring and analysis are required; 0.6≤C<0.8, four-level poor clustering, the distance between the data point and the cluster center is large, the clustering effect is poor, this type of traffic is abnormal traffic, and further safety measures need to be taken immediately; 0.8≤C<1, five-level extreme difference clustering, the data points and the cluster center are very scattered, the clustering effect is very poor, this type of traffic is abnormal traffic, and further safety measures must be taken immediately.

6. A computer network security monitoring method according to claim 5, characterized in that: The suspicious traffic levels and response strategies are as follows: Level 1 Excellent Cluster: Low risk, normal traffic, continue to monitor records; Level 2 good clustering: medium-low risk, normal traffic, slight anomalies, continue to monitor records; Level 3 medium clustering: medium risk, suspicious traffic partially matches attack characteristics, may be in the early stage of attack, need to be isolated, replay traffic and issue a warning; Level 4 poor clustering: high risk, abnormal traffic, obvious attack characteristics, automatic blocking, activation of the intrusion prevention system and alarm notification to management personnel; Level 5 extreme clustering: severe risk, abnormal traffic, obvious attack behavior, serious damage has been caused, the entire network is isolated, emergency response and alarm notification to management personnel.

7. A computer network security monitoring method according to claim 6, characterized in that: The analysis and comparison of the abnormal traffic and the attack signature library includes: Rule-based matching: Use the rule engine to compare the characteristics of abnormal traffic with the rules in the attack library one by one; Signature-based matching: Compare the characteristics of abnormal traffic with known signatures in the attack library, and find malicious attack signatures through deep detection of traffic packets; Similarity-based matching: Matching is performed by calculating the similarity between abnormal traffic and attack behaviors in the attack signature library. The specific formula is as follows: Among them, A is the abnormal traffic feature set, and B is the supply feature set in the attack feature library.

8. A computer network security monitoring system, based on a computer network security monitoring method according to any one of claims 1 to 7, characterized in that: Specifically include: Data acquisition module: including network traffic monitoring unit, data feature extraction unit and data caching and preprocessing unit; Data analysis module: including deep clustering unit and grade evaluation unit; Hazard identification and classification module: including classification unit and flow characteristic marking unit; Dynamic monitoring and early warning module: including real-time monitoring unit, early warning notification unit and suspicious traffic tracking unit; Automatic response module: including danger level assessment unit, response strategy generation unit and automatic defense unit; Abnormal traffic analysis module: including attack feature library unit, attack feature library update unit, feature matching unit and attack identification unit; Analysis and optimization module: includes log recording unit, audit report generation unit and model feedback optimization unit.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a computer network security monitoring method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a computer network security monitoring method described in any one of claims 1 to 7 are implemented.

Images