Computer network communication security monitoring method and system

Abstract

The invention discloses a computer network communication security monitoring method and system, and relates to the technical field of communication monitoring, in the communication process, traffic data, VPN connection and data packets are detected in real time in combination with a Grubbs detection algorithm, whether outliers exist in the traffic data, the VPN connection and the data packets or not is analyzed, and when it is monitored that communication abnormality does not exist, the outliers exist in the data packets. And if yes, obtaining the flow data, the VPN connection and G values obtained by calculation of the data packet through a Grubbs detection algorithm, carrying out weighted calculation on the plurality of G values to generate a communication assignment, generating a corresponding control strategy based on a comparison result of the communication assignment and a gradient anomaly threshold, and analyzing the communication quality after the communication is finished. According to the monitoring method, when no communication abnormity is monitored, after the flow data, the VPN connection and the G value of the data packet are comprehensively analyzed, secondary analysis is carried out on the communication security, and the security of communication monitoring is further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of communication monitoring, and in particular to a computer network communication security monitoring method and system. Background Art

[0002] With the development of information technology, a large amount of sensitive information is transmitted through computer networks, such as personal privacy, financial data, etc. In order to ensure the security of this information, communication security monitoring needs to adopt encryption and authentication technologies to prevent unauthorized access and data leakage.

[0003] The prior art has the following deficiencies:

[0004] Existing monitoring methods mainly focus on monitoring specific dimensions, such as analysis of traffic data, VPN connections or data packets. Single-dimensional monitoring may lead to neglect of comprehensive issues, because attackers may use multiple means to attack. Lack of comprehensive analysis may make the system insufficiently aware of multiple threats, thus failing to ensure the security of communications. Summary of the invention

[0005] The object of the present invention is to provide a computer network communication security monitoring method and system to solve the deficiencies in the background technology.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a computer network communication security monitoring method, the monitoring method comprising the following steps:

[0007] Before communication, the monitoring system detects whether there is abnormal traffic in the computer network based on the algorithm of temporal pattern recognition, and identifies whether there are outliers in the traffic data through the Grubbs detection algorithm. If there is no abnormal traffic and there are no outliers in the traffic data, the monitoring system prompts that the computer network supports communication;

[0008] During the communication process, VPN connections are monitored based on the protocol analysis algorithm to identify potential anomalies in VPN communications, and the VPN connection pattern is detected using the Grubbs detection algorithm to detect outliers.

[0009] Perform real-time filtering and deep inspection of incoming and outgoing communication packets to identify whether there are threats in the packets, and use the Grubbs detection algorithm to detect whether there are outliers in the packets;

[0010] If there is a communication anomaly in the monitoring, the monitoring system directly controls the communication interruption. If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained to obtain the G value calculated by the Grubbs detection algorithm, and multiple G values ​​are weighted to generate a communication assignment. Based on the comparison result of the communication assignment and the gradient anomaly threshold, the corresponding control strategy is generated;

[0011] After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated by a polynomial algorithm, the communication quality is analyzed, and the analysis results are sent to the administrator and stored in the database for subsequent analysis.

[0012] Preferably, the communication anomaly includes abnormal network traffic, potential anomaly in VPN communication, data packet threat or the presence of outliers.

[0013] Preferably, the Grubbs detection algorithm is used to identify whether there are outliers in the flow data, including the following steps:

[0014] Get several data points in the traffic data and calculate the X value of each data point. The expression is: Where, X i represents the X value of the ith data point, x i represents the flow value of the ith data point, x avg represents the average flow rate, and a represents the standard deviation of the flow data;

[0015] Calculate the Grubbs statistic (G value) of traffic data. The function expression is:

[0016] Where N1 is the number of data points in the flow data, X i represents the X value of the i-th data point, G1 represents the G value of the flow data, max(X i ) means selecting the maximum X value among i data points;

[0017] The G value of the acquired flow data is compared with the preset flow discrete threshold. If the G value of the flow data is greater than the flow discrete threshold, the flow data is analyzed to determine whether there are outliers and whether the flow data is abnormal.

[0018] The VPN connection mode is detected using the Grubbs detection algorithm to detect whether there are outliers, including the following steps:

[0019] Get several data points in the VPN connection and calculate the Y value of each data point. The expression is: Where Y i Represents the Y value of the i-th data point, y i represents the data transmission rate of the i-th data point, y avg represents the average data transmission rate, and b represents the standard deviation of VPN connections;

[0020] Calculate the Grubbs statistic (G value) of the VPN connection. The function expression is:

[0021] Where N2 is the number of data points in the VPN connection, Yi represents the Y value of the i-th data point, G2 represents the G value of the VPN connection, max(Y i ) means selecting the maximum Y value among i data points;

[0022] The obtained G value of the VPN connection is compared with the preset VPN discrete threshold. If the G value of the VPN connection is greater than the VPN discrete threshold, it is analyzed that there are outliers in the VPN connection, and it is determined that the VPN connection is abnormal.

[0023] The Grubbs detection algorithm is used to detect whether a data packet has outliers, including the following steps:

[0024] Get several data points in the data packet and calculate the Z value of each data point. The expression is: In the formula, Z i represents the Z value of the ith data point, z i represents the transmission time interval of the ith data point, z avg represents the average transmission time interval, c represents the standard deviation of the data packets;

[0025] Calculate the Grubbs statistic (G value) of the data packet. The function expression is:

[0026] Where N3 is the number of data points in the data packet, Z i represents the Z value of the ith data point, G3 represents the G value of the data packet, max(Z i ) means selecting the maximum Z value among i data points;

[0027] The G value of the acquired data packet is compared with the preset data packet discrete threshold. If the G value of the data packet is greater than the data packet discrete threshold, the data packet is analyzed to determine whether there is an outlier and whether the data packet is abnormal.

[0028] Preferably, if there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained by calculating the G value obtained by the Grubbs detection algorithm, and a plurality of G values ​​are weightedly calculated to generate a communication assignment, including the following steps:

[0029] During the communication process, the G value of the traffic data, the G value of the VPN connection, and the G value of the data packet are obtained regularly;

[0030] The G value of the traffic data, the G value of the VPN connection and the G value of the data packet are comprehensively weighted to obtain the communication value, and the expression is: tfz=ω1*G1+ω2*G2+ω3*G3, where tfz is the communication value, G1, G2, G3 are the G value of the traffic data, the G value of the VPN connection and the G value of the data packet respectively, ω1, ω2, ω3 are the weight coefficients of the G value of the traffic data, the G value of the VPN connection and the G value of the data packet respectively, and ω1+ω2+ω3=1, ω2>ω1=ω3.

[0031] Preferably, generating a corresponding control strategy based on the comparison result of the communication assignment and the gradient abnormality threshold comprises the following steps:

[0032] After obtaining the communication value at regular intervals, the communication value is compared with the gradient threshold, the gradient threshold includes a first abnormality threshold and a second abnormality threshold, the first abnormality threshold is used to analyze whether there is an abnormality in the communication process, and the second abnormality threshold is used to analyze the severity of the communication abnormality;

[0033] If the communication value is less than the first abnormality threshold, it is analyzed that there is no abnormality in the communication process;

[0034] If the communication value is greater than or equal to the first abnormality threshold, an abnormality exists in the communication process;

[0035] If the communication value is greater than or equal to the first abnormal threshold, and the communication value is less than the second abnormal threshold, it is analyzed that there is a slight abnormality in the communication process, indicating that the communication can continue. At this time, the monitoring system does not process the communication, but sends a warning to the user, and the user can choose whether to continue the communication;

[0036] If the communication value is greater than or equal to the second abnormality threshold, it is analyzed that there is a serious abnormality in the communication process, indicating that continued communication is not supported, and the monitoring system directly disconnects the communication.

[0037] Preferably, after the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated by a polynomial algorithm, and then the communication quality is analyzed, including the following steps:

[0038] After the communication is completed, the communication assignments obtained multiple times during the communication process are obtained, and the average communication assignment of the multiple communication assignments is calculated;

[0039] The communication interruption frequency during the communication process is obtained through the communication monitoring tool, and the average communication value and the communication interruption frequency are calculated through a polynomial algorithm to obtain the quality coefficient. The expression is:

[0040] Zxs=α*tfz avg +β*zdp; where Zxs is the quality coefficient, tfz avg, zdp are respectively the average communication assignment and the communication interruption frequency, α and β are respectively the proportional coefficients of the average communication assignment and the communication interruption frequency, and α and β are both greater than 0;

[0041] The quality coefficient is compared with the preset quality threshold. If the quality coefficient is less than or equal to the quality threshold, the communication quality is considered qualified. If the quality coefficient is greater than the quality threshold, the communication quality is considered unqualified. The analysis results are sent to the administrator and stored in the database for subsequent analysis.

[0042] Preferably, before the communication, the monitoring system detects whether there is abnormal traffic in the computer network based on a time sequence pattern recognition algorithm, including the following steps:

[0043] Use network packet capture tools to capture real-time data packets from the network. The data packets include the transmitted information, data packet size, and transmission rate. Arrange the captured data packets in chronological order to form a time series data sequence.

[0044] Use time windows to divide time series data into small time periods, extract features from each time window, calculate the mean and standard deviation of the packet size in each time window to model the time series pattern, compare the real-time traffic data with the modeled time series pattern, and detect whether there are any anomalies that do not match the normal traffic pattern.

[0045] Preferably, during the communication process, monitoring the VPN connection based on the protocol analysis algorithm to identify whether there is a potential anomaly in the VPN communication includes the following steps:

[0046] Capture network traffic data of VPN communications, including transmitted data packets, protocol types, source and destination IP address information, use network packet capture tools or monitoring equipment to capture data packets passing through the VPN connection, and perform protocol analysis on the captured VPN traffic to identify the protocol used in the communication;

[0047] Analyze the header information of the data packet to determine the type of protocol used, extract protocol features from VPN communications, and use known protocol specifications and feature information to build a model of VPN communication behavior, including allowed protocol versions, encryption algorithms, and authentication methods;

[0048] During the communication process, the real-time VPN traffic is analyzed and compared with the model of VPN communication behavior. The protocol characteristics of the real-time VPN traffic are checked to see if they match the established protocol behavior model, and situations that are inconsistent with normal behavior are identified.

[0049] Preferably, real-time filtering and deep detection of incoming and outgoing communication data packets are performed to identify whether the data packets contain threats, including the following steps:

[0050] Capture incoming and outgoing data packets, obtain detailed information about the data packets, including source address, destination address, protocol type, and data size, and use network packet capture tools or firewall devices to intercept data packets passing through network devices;

[0051] Use firewalls or intrusion detection systems to filter incoming and outgoing data packets in real time based on source address, destination address, and protocol information. Use deep packet inspection tools to perform deep parsing on data packets that pass real-time filtering to further analyze the content and structure of data packets, including data payload and protocol header.

[0052] Use malicious code scanning engines and intrusion detection systems to detect whether there are malicious features in data packets, including malicious code and attack signatures, perform feature matching on data packets to identify whether they contain known malicious features, analyze the behavior in data packets, and detect whether there are abnormal behaviors.

[0053] A computer network communication security monitoring system, comprising a flow monitoring module, a judgment module, a VPN monitoring module, a data packet monitoring module, a detection module, a communication interruption module, a secondary analysis module, and a quality analysis module;

[0054] Traffic monitoring module: Before communication, it detects whether there is abnormal traffic in the computer network based on the algorithm of time series pattern recognition, and identifies whether there are outliers in the traffic data through the Grubbs detection algorithm;

[0055] Judgment module: if there is no abnormal traffic and the traffic data has no outliers, it prompts that the computer network supports communication, and wakes up the VPN monitoring module, the data packet monitoring module and the detection module;

[0056] VPN monitoring module: During the communication process, it monitors VPN connections based on protocol analysis algorithms to identify potential anomalies in VPN communications;

[0057] Packet monitoring module: performs real-time filtering and deep detection of incoming and outgoing communication packets to identify whether there are threats in the packets;

[0058] Detection module: detects whether there are outliers in the VPN connection mode through the Grubbs detection algorithm, and detects whether there are outliers in the data packet through the Grubbs detection algorithm;

[0059] Communication interruption module: If there is communication anomaly detected, including abnormal network traffic, potential VPN communication anomaly, data packet threat or outlier, the communication interruption will be directly controlled;

[0060] Secondary analysis module: If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained by calculating the G value through the Grubbs detection algorithm, and a communication assignment is generated after weighted calculation of multiple G values. The corresponding control strategy is generated based on the comparison result between the communication assignment and the gradient anomaly threshold;

[0061] Quality analysis module: After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated through a polynomial algorithm, and the communication quality is analyzed. The analysis results are sent to the administrator and database storage for subsequent analysis.

[0062] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0063] The present invention analyzes whether a computer network supports communication before communication, and detects flow data, VPN connection and data packets in real time in the communication process in combination with the Grubbs detection algorithm, analyzes whether there are outliers in the flow data, VPN connection and data packets, and improves the security monitoring effect. When there is no communication anomaly in the monitoring, the G value calculated by the Grubbs detection algorithm for the flow data, VPN connection and data packets is obtained, and a communication assignment is generated after weighted calculation of multiple G values, and a corresponding control strategy is generated based on the comparison result of the communication assignment and the gradient anomaly threshold. After the communication is completed, the average communication assignment and the communication interruption frequency in the communication process are calculated by a polynomial algorithm, and the communication quality is analyzed. The monitoring method can perform a secondary analysis on the communication security after comprehensively analyzing the G value of the flow data, VPN connection and data packet when there is no communication anomaly in the monitoring, and further improve the security of the communication monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0065] Figure 1 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] Example 1: Please refer to Figure 1 As shown, the computer network communication security monitoring method described in this embodiment includes the following steps:

[0068] Before the monitoring system communicates, it detects whether there is abnormal traffic in the computer network based on the algorithm of temporal pattern recognition, including the following steps:

[0069] Use a network packet capture tool to capture real-time data packets from the network. These data packets include the transmitted information, packet size, transmission rate, etc. Arrange the captured data packets in chronological order to form a time series data sequence. Use time windows to divide the time series data into small time periods, such as one time window per second. Extract features from each time window, such as the average size of the data packets in the time period, the transmission rate, etc. Use statistical-based methods, such as calculating the mean and standard deviation of the packet size in each time window, to model the normal time series pattern. Compare the real-time traffic data with the modeled normal time series pattern to detect whether there are anomalies that do not match the normal traffic pattern. For example, the packet size in a certain time window is detected to be much higher than normal. When abnormal traffic is detected, the system generates an alarm. For example, the system can send an alarm to the administrator to remind him that there may be network anomalies.

[0070] The Grubbs detection algorithm is used to identify whether there are outliers in the traffic data. If there is no abnormal traffic and the traffic data has no outliers, the monitoring system prompts that the computer network supports communication. During the communication process, the VPN connection is monitored based on the protocol analysis algorithm to identify whether there are potential anomalies in the VPN communication, including the following steps:

[0071] Capture network traffic data of VPN communication, including information such as transmitted packets, protocol type, source and destination IP addresses, etc. Use network packet capture tools or monitoring equipment to capture packets passing through the VPN connection. Perform protocol parsing on the captured VPN traffic to identify the protocol used in the communication. Analyze the header information of the packet to determine the type of protocol used, such as IPsec, OpenVPN, etc. Extract protocol features from VPN communication, including protocol version, encryption algorithm, authentication method, etc. Extract feature information related to the protocol according to the protocol specification, which will be used for subsequent anomaly detection.

[0072] Establish a protocol behavior model for normal VPN communication for subsequent comparison and anomaly detection. Use known protocol specifications and feature information to establish a model of normal VPN communication behavior, including allowed protocol versions, encryption algorithms, authentication methods, etc. Analyze real-time VPN traffic during communication and compare it with the normal protocol behavior model. Check whether the protocol characteristics of real-time VPN traffic match the established protocol behavior model, compare parameters such as version and encryption algorithm, and identify situations that do not match normal behavior. When potential anomalies are detected in VPN communication, trigger the alarm mechanism to determine whether the real-time traffic is significantly different from the normal protocol behavior model. If there is an anomaly, trigger an alarm to notify the administrator or relevant personnel.

[0073] The VPN connection mode is detected by the Grubbs detection algorithm to see if there are outliers. The incoming and outgoing data packets are filtered and deeply inspected in real time to identify whether there are threats in the data packets. The following steps are included:

[0074] Capture incoming and outgoing communication packets and obtain detailed information about the packets, including source address, destination address, protocol type, data size, etc. Use network packet capture tools or firewall devices to intercept packets passing through network devices. Perform real-time filtering on incoming and outgoing packets, and discard or allow specific types of packets based on pre-defined rules or policies. Use devices such as firewalls or intrusion detection systems (IDS) to perform real-time filtering based on information such as source address, destination address, and protocol. Perform deep parsing on packets that pass real-time filtering to further analyze the content and structure of the packets. Use deep packet inspection tools to parse packets to obtain more detailed information, such as data payload, protocol header, etc.

[0075] Based on deep analysis, detect whether there are malicious features in the data packet, such as malicious code, attack signatures, etc. Use malicious code scanning engines, intrusion detection systems, etc. to match the features of the data packet to identify whether it contains known malicious features. Analyze the behavior in the data packet to detect whether there is abnormal behavior, such as a large number of retries, abnormal data transmission rates, etc. Use behavioral analysis algorithms to model the timing behavior of the data packet and identify whether it is consistent with normal behavior. When threats or abnormal behaviors are detected in the data packet, trigger the alarm mechanism. Send an alarm to the Security Information and Event Management System (SIEM) or notify the administrator through other alarm channels.

[0076] The Grubbs detection algorithm is used to detect whether there are outliers in the data packet. If there is a communication anomaly in the monitoring, the communication anomaly includes abnormal network traffic, potential abnormal VPN communication, data packet threat or outliers, and the monitoring system directly controls the communication interruption, including the following steps:

[0077] The monitoring system detects communication anomalies, which may include abnormal network traffic, potential VPN communication anomalies, packet threats, or outliers. Use the aforementioned monitoring methods, such as those based on timing pattern recognition, protocol analysis, deep packet inspection, etc. to trigger the anomaly detection mechanism. Confirm the specific type of the monitored communication anomaly to determine whether it is abnormal network traffic, VPN communication anomaly, packet threat, or outlier. Analyze the specific features and contextual information that triggered the anomaly detection to confirm the specific type of anomaly. Based on the anomaly type and security policy, decide whether communication interruption is necessary, formulate security policies, and define the conditions and urgency for triggering communication interruption so that the system can make interruption decisions automatically or semi-automatically.

[0078] If it is decided to interrupt communication, take appropriate measures to interrupt communication to prevent the spread of potential threats. Use firewall rules, router configuration and other means to directly interrupt the connection with the affected communication endpoints. After executing the communication interruption, notify the relevant security team, administrator or other relevant personnel. Trigger the alarm notification mechanism to send notifications to pre-defined contacts to remind them that a communication interruption has occurred. Record the communication interruption event and generate corresponding reports and logs for subsequent analysis and auditing. Record the detailed information of the communication interruption event in the security information and event management system (SIEM) for subsequent investigation and analysis. After confirming that the problem has been resolved and the communication environment is secure, you can consider restoring communication. Based on the security assessment and problem solving, restore the normal state of the affected communication through appropriate means.

[0079] If there is no communication anomaly during monitoring, the traffic data, VPN connection and data packet are obtained to obtain the G value calculated by the Grubbs detection algorithm, and multiple G values ​​are weighted to generate a communication assignment. Based on the comparison result of the communication assignment and the gradient anomaly threshold, the corresponding control strategy is generated. After the communication is completed, the average communication assignment and the communication interruption frequency during the communication process are calculated by the polynomial algorithm, and the communication quality is analyzed. The analysis results are sent to the administrator and database storage for subsequent analysis.

[0080] This application analyzes whether the computer network supports communication before communication, and during the communication process, combines the Grubbs detection algorithm to detect traffic data, VPN connections and data packets in real time, analyzes whether there are outliers in the traffic data, VPN connections and data packets, and improves the security monitoring effect. When there is no communication anomaly in the monitoring, the G value calculated by the Grubbs detection algorithm for the traffic data, VPN connections and data packets is obtained, and a communication assignment is generated after weighted calculation of multiple G values. The corresponding control strategy is generated based on the comparison result of the communication assignment and the gradient anomaly threshold. After the communication is completed, the average communication assignment and the communication interruption frequency in the communication process are calculated by the polynomial algorithm, and the communication quality is analyzed. This monitoring method can perform a secondary analysis of communication security after comprehensively analyzing the G values ​​of traffic data, VPN connections and data packets when there is no communication anomaly in the monitoring, and further improve the security of communication monitoring.

[0081] Embodiment 2: Before the communication is performed, the monitoring system detects whether there is abnormal traffic in the computer network based on the algorithm of time series pattern recognition, and identifies whether there are outliers in the traffic data through the Grubbs detection algorithm. If there is no abnormal traffic and the traffic data has no outliers, the monitoring system prompts the computer network to support communication, including the following steps:

[0082] Get several data points in the traffic data and calculate the X value of each data point. The expression is: Where, X i represents the X value of the ith data point, x i represents the flow value of the ith data point, x avg represents the average flow, a represents the standard deviation of flow data, and the function expression of the standard deviation of flow data is: In the formula, x i represents the flow value of the ith data point, x avg represents the average flow rate, i = 1, 2, ..., N1, N1 is the number of data points in the flow data;

[0083] Then calculate the Grubbs statistic (G value) of the traffic data, and the function expression is:

[0084] Where N1 is the number of data points in the flow data, X i represents the X value of the i-th data point, G1 represents the G value of the flow data, max(X i ) means selecting the maximum X value among i data points;

[0085] The G value of the acquired flow data is compared with the preset flow discrete threshold. If the G value of the flow data is greater than the flow discrete threshold, the flow data is analyzed to determine whether there are outliers and whether the flow data is abnormal.

[0086] During the communication process, VPN connections are monitored based on the protocol analysis algorithm to identify potential anomalies in VPN communications, and the VPN connection mode is detected by the Grubbs detection algorithm to detect outliers, including the following steps:

[0087] Get several data points in the VPN connection and calculate the Y value of each data point. The expression is: Where Y i Represents the Y value of the i-th data point, y i represents the data transmission rate of the i-th data point, y avg represents the average data transmission rate, b represents the VPN connection standard deviation, and the VPN connection standard deviation function expression is: In the formula, y i represents the data transmission rate of the i-th data point, y avg represents the average data transmission rate, i=1, 2, ..., N2, N2 is the number of data points in the VPN connection;

[0088] Then calculate the Grubbs statistic (G value) of the VPN connection, and the function expression is:

[0089] Where N2 is the number of data points in the VPN connection, Y i represents the Y value of the i-th data point, G2 represents the G value of the VPN connection, max(Y i ) means selecting the maximum Y value among i data points;

[0090] The obtained G value of the VPN connection is compared with the preset VPN discrete threshold. If the G value of the VPN connection is greater than the VPN discrete threshold, it is analyzed that there are outliers in the VPN connection, and it is determined that the VPN connection is abnormal.

[0091] Perform real-time filtering and deep inspection of incoming and outgoing data packets to identify whether there are threats in the data packets, and use the Grubbs detection algorithm to detect whether there are outliers in the data packets, including the following steps:

[0092] Get several data points in the data packet and calculate the Z value of each data point. The expression is: In the formula, Z i represents the Z value of the ith data point, z i represents the transmission time interval of the ith data point, z avg represents the average transmission time interval, c represents the standard deviation of the data packet, and the function expression of the standard deviation of the data packet is: In the formula, z i represents the transmission time interval of the ith data point, z avgrepresents the average transmission time interval, i=1, 2, ..., N3, N3 is the number of data points in the data packet;

[0093] Then calculate the Grubbs statistic (G value) of the data packet, the function expression is:

[0094] Where N3 is the number of data points in the data packet, Z i represents the Z value of the ith data point, G3 represents the G value of the data packet, max(Z i ) means selecting the maximum Z value among i data points;

[0095] The G value of the acquired data packet is compared with the preset data packet discrete threshold. If the G value of the data packet is greater than the data packet discrete threshold, the data packet is analyzed to determine whether there is an outlier and whether the data packet is abnormal.

[0096] If there is a communication anomaly in the monitoring, which includes abnormal network traffic, potential VPN communication anomaly, data packet threat or outlier, the monitoring system directly controls the communication interruption. If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained by G value calculated by Grubbs detection algorithm, and multiple G values ​​are weighted and calculated to generate communication assignment. Based on the comparison result of communication assignment and gradient anomaly threshold, the corresponding control strategy is generated, including the following steps:

[0097] During the communication process, the G value of the traffic data, the G value of the VPN connection, and the G value of the data packet are obtained regularly;

[0098] The G value of the traffic data, the G value of the VPN connection, and the G value of the data packet are comprehensively weighted to obtain the communication value, and the expression is: tfz=0.3*G1+0.4*G2+0.3*G3, where tfz is the communication value, G1, G2, and G3 are the G value of the traffic data, the G value of the VPN connection, and the G value of the data packet, respectively.

[0099] After obtaining the communication value at regular intervals, the communication value is compared with the gradient threshold, the gradient threshold includes a first abnormality threshold and a second abnormality threshold, the first abnormality threshold is used to analyze whether there is an abnormality in the communication process, and the second abnormality threshold is used to analyze the severity of the communication abnormality;

[0100] If the communication value is less than the first abnormality threshold, it is analyzed that there is no abnormality in the communication process;

[0101] If the communication value is greater than or equal to the first abnormality threshold, an abnormality exists in the communication process;

[0102] If the communication value is greater than or equal to the first abnormal threshold, and the communication value is less than the second abnormal threshold, it is analyzed that there is a slight abnormality in the communication process, indicating that the communication can continue. At this time, the monitoring system does not process the communication, but sends a warning to the user, and the user can choose whether to continue the communication;

[0103] If the communication value is greater than or equal to the second abnormality threshold, it is analyzed that there is a serious abnormality in the communication process, indicating that continued communication is not supported, and the monitoring system directly disconnects the communication.

[0104] After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated by a polynomial algorithm, and the communication quality is analyzed. The analysis results are sent to the administrator and stored in the database for subsequent analysis, including the following steps:

[0105] After the communication is completed, the communication assignments obtained multiple times during the communication process are obtained, and the average communication assignment of the multiple communication assignments is calculated;

[0106] The communication interruption frequency during the communication process is obtained through the communication monitoring tool, and the average communication value and the communication interruption frequency are calculated through a polynomial algorithm to obtain the quality coefficient. The expression is:

[0107] Zxs=α*tfz avg +β*zdp; where Zxs is the quality coefficient, tfz avg , zdp are respectively the average communication assignment and the communication interruption frequency, α and β are respectively the proportional coefficients of the average communication assignment and the communication interruption frequency, and α and β are both greater than 0;

[0108] The quality coefficient is compared with the preset quality threshold. If the quality coefficient is less than or equal to the quality threshold, the communication quality analysis is qualified. If the quality coefficient is greater than the quality threshold, the communication quality analysis is unqualified. The analysis results are sent to the administrator and database storage for subsequent analysis. When the analysis quality is unqualified, the administrator needs to maintain the computer and the computer network in time.

[0109] Embodiment 3: A computer network communication security monitoring system described in this embodiment includes a flow monitoring module, a judgment module, a VPN monitoring module, a data packet monitoring module, a detection module, a communication interruption module, a secondary analysis module, and a quality analysis module;

[0110] Traffic monitoring module: Before communication, it detects whether there is abnormal traffic in the computer network based on the algorithm of time series pattern recognition, and identifies whether there are outliers in the traffic data through the Grubbs detection algorithm. The detection results and identification results are sent to the judgment module;

[0111] Judgment module: if there is no abnormal traffic and the traffic data has no outliers, it prompts that the computer network supports communication, and wakes up the VPN monitoring module, the data packet monitoring module and the detection module;

[0112] VPN monitoring module: During the communication process, it monitors the VPN connection based on the protocol analysis algorithm, identifies whether there are potential anomalies in the VPN communication, and sends the identification results to the communication interruption module and the secondary analysis module;

[0113] Packet monitoring module: performs real-time filtering and in-depth detection of incoming and outgoing communication packets to identify whether there are threats in the packets, and sends the identification results to the communication interruption module and the secondary analysis module;

[0114] Detection module: detects whether there are outliers in the VPN connection mode through the Grubbs detection algorithm, detects whether there are outliers in the data packet through the Grubbs detection algorithm, and sends the detection results to the communication interruption module and the secondary analysis module;

[0115] Communication interruption module: If there is communication anomaly detected, including abnormal network traffic, potential VPN communication anomaly, data packet threat or outlier, the communication interruption will be directly controlled;

[0116] Secondary analysis module: If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained by calculating the G value through the Grubbs detection algorithm, and multiple G values ​​are weighted to generate a communication assignment. Based on the comparison result of the communication assignment and the gradient anomaly threshold, the corresponding control strategy is generated, and the communication assignment is sent to the quality analysis module;

[0117] Quality analysis module: After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated through a polynomial algorithm, and the communication quality is analyzed. The analysis results are sent to the administrator and database storage for subsequent analysis.

[0118] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0119] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0120] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A computer network communication security monitoring method, characterized in that: The monitoring method comprises the following steps: Before communication, the monitoring system detects whether there is abnormal traffic in the computer network based on the algorithm of temporal pattern recognition, and identifies whether there are outliers in the traffic data through the Grubbs detection algorithm. If there is no abnormal traffic and there are no outliers in the traffic data, the monitoring system prompts that the computer network supports communication; During the communication process, VPN connections are monitored based on the protocol analysis algorithm to identify potential anomalies in VPN communications, and the VPN connection pattern is detected using the Grubbs detection algorithm to detect outliers. Perform real-time filtering and deep inspection of incoming and outgoing communication packets to identify whether there are threats in the packets, and use the Grubbs detection algorithm to detect whether there are outliers in the packets; If there is a communication anomaly in the monitoring, the monitoring system directly controls the communication interruption. If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained to obtain the G value calculated by the Grubbs detection algorithm, and multiple G values ​​are weighted to generate a communication assignment. Based on the comparison result of the communication assignment and the gradient anomaly threshold, the corresponding control strategy is generated; After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated by a polynomial algorithm, the communication quality is analyzed, and the analysis results are sent to the administrator and stored in the database for subsequent analysis.

2. A computer network communication security monitoring method according to claim 1, characterized in that: The communication anomaly includes abnormal network traffic, potential VPN communication anomaly, data packet threat or outlier existence.

3. A computer network communication security monitoring method according to claim 2, characterized in that: The Grubbs detection algorithm is used to identify whether there are outliers in the traffic data, including the following steps: Get several data points in the traffic data and calculate the X value of each data point. The expression is: In the formula, Xi represents the X value of the i-th data point, xi represents the flow value of the i-th data point, xavg represents the average flow, and a represents the standard deviation of the flow data; Calculate the Grubbs statistic (G value) of traffic data. The function expression is: Where N1 is the number of data points in the flow data, X i represents the X value of the i-th data point, G1 represents the G value of the flow data, max(X i ) means selecting the maximum X value among i data points; The G value of the acquired flow data is compared with the preset flow discrete threshold. If the G value of the flow data is greater than the flow discrete threshold, the flow data is analyzed to determine whether there are outliers and whether the flow data is abnormal. The VPN connection mode is detected using the Grubbs detection algorithm to detect whether there are outliers, including the following steps: Get several data points in the VPN connection and calculate the Y value of each data point. The expression is: Where Y i Represents the Y value of the i-th data point, y i represents the data transmission rate of the i-th data point, y avg represents the average data transmission rate, and b represents the standard deviation of VPN connections; Calculate the Grubbs statistic (G value) of the VPN connection. The function expression is: Where N2 is the number of data points in the VPN connection, Y i represents the Y value of the i-th data point, G2 represents the G value of the VPN connection, max(Y i ) means selecting the maximum Y value among i data points; The obtained G value of the VPN connection is compared with the preset VPN discrete threshold. If the G value of the VPN connection is greater than the VPN discrete threshold, it is analyzed that there are outliers in the VPN connection, and it is determined that the VPN connection is abnormal. The Grubbs detection algorithm is used to detect whether a data packet has outliers, including the following steps: Get several data points in the data packet and calculate the Z value of each data point. The expression is: In the formula, Z i represents the Z value of the ith data point, z i represents the transmission time interval of the ith data point, z avg represents the average transmission time interval, c represents the standard deviation of the data packets; Calculate the Grubbs statistic (G value) of the data packet. The function expression is: Where N3 is the number of data points in the data packet, Z i represents the Z value of the ith data point, G3 represents the G value of the data packet, max(Z i ) means selecting the maximum Z value among i data points; The G value of the acquired data packet is compared with the preset data packet discrete threshold. If the G value of the data packet is greater than the data packet discrete threshold, the data packet is analyzed to determine whether there is an outlier and whether the data packet is abnormal.

4. A computer network communication security monitoring method according to claim 3, characterized in that: If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained by calculating the G value through the Grubbs detection algorithm, and a communication value is generated after weighted calculation of multiple G values, including the following steps: During the communication process, the G value of the traffic data, the G value of the VPN connection, and the G value of the data packet are obtained regularly; The G value of the traffic data, the G value of the VPN connection and the G value of the data packet are comprehensively weighted to obtain the communication value, and the expression is: tfz=ω1*G1+ω2*G2+ω3*G3, where tfz is the communication value, G1, G2, G3 are the G value of the traffic data, the G value of the VPN connection and the G value of the data packet respectively, ω1, ω2, ω3 are the weight coefficients of the G value of the traffic data, the G value of the VPN connection and the G value of the data packet respectively, and ω1+ω2+ω3=1, ω2>ω1=ω3.

5. A computer network communication security monitoring method according to claim 4, characterized in that: Based on the comparison results of the communication assignment and the gradient abnormality threshold, a corresponding control strategy is generated, including the following steps: After obtaining the communication value at regular intervals, the communication value is compared with the gradient threshold, the gradient threshold includes a first abnormality threshold and a second abnormality threshold, the first abnormality threshold is used to analyze whether there is an abnormality in the communication process, and the second abnormality threshold is used to analyze the severity of the communication abnormality; If the communication value is less than the first abnormality threshold, it is analyzed that there is no abnormality in the communication process; If the communication value is greater than or equal to the first abnormality threshold, an abnormality exists in the communication process; If the communication value is greater than or equal to the first abnormal threshold, and the communication value is less than the second abnormal threshold, it is analyzed that there is a slight abnormality in the communication process, indicating that the communication can continue. At this time, the monitoring system does not process the communication, but sends a warning to the user, and the user can choose whether to continue the communication; If the communication value is greater than or equal to the second abnormality threshold, it is analyzed that there is a serious abnormality in the communication process, indicating that continued communication is not supported, and the monitoring system directly disconnects the communication.

6. A computer network communication security monitoring method according to claim 5, characterized in that: After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated by a polynomial algorithm, and the communication quality is analyzed, including the following steps: After the communication is completed, the communication assignments obtained multiple times during the communication process are obtained, and the average communication assignment of the multiple communication assignments is calculated; The communication interruption frequency during the communication process is obtained through the communication monitoring tool, and the average communication value and the communication interruption frequency are calculated through a polynomial algorithm to obtain the quality coefficient. The expression is: Zxs=α*tfz avg +β*zdp; where Zxs is the quality coefficient, tfz avg , zdp are respectively the average communication assignment and the communication interruption frequency, α and β are respectively the proportional coefficients of the average communication assignment and the communication interruption frequency, and α and β are both greater than 0; The quality coefficient is compared with the preset quality threshold. If the quality coefficient is less than or equal to the quality threshold, the communication quality is considered qualified. If the quality coefficient is greater than the quality threshold, the communication quality is considered unqualified. The analysis results are sent to the administrator and stored in the database for subsequent analysis.

7. A computer network communication security monitoring method according to claim 6, characterized in that: Before the monitoring system communicates, it detects whether there is abnormal traffic in the computer network based on the algorithm of temporal pattern recognition, including the following steps: Use network packet capture tools to capture real-time data packets from the network. The data packets include the transmitted information, data packet size, and transmission rate. Arrange the captured data packets in chronological order to form a time series data sequence. Use time windows to divide time series data into small time periods, extract features from each time window, calculate the mean and standard deviation of the packet size in each time window to model the time series pattern, compare the real-time traffic data with the modeled time series pattern, and detect whether there are any anomalies that do not match the normal traffic pattern.

8. A computer network communication security monitoring method according to claim 7, characterized in that: During the communication process, VPN connections are monitored based on protocol analysis algorithms to identify potential anomalies in VPN communications, including the following steps: Capture network traffic data of VPN communications, including transmitted data packets, protocol types, source and destination IP address information, use network packet capture tools or monitoring equipment to capture data packets passing through the VPN connection, and perform protocol analysis on the captured VPN traffic to identify the protocol used in the communication; Analyze the header information of the data packet to determine the type of protocol used, extract protocol features from VPN communications, and use known protocol specifications and feature information to build a model of VPN communication behavior, including allowed protocol versions, encryption algorithms, and authentication methods; During the communication process, the real-time VPN traffic is analyzed and compared with the model of VPN communication behavior. The protocol characteristics of the real-time VPN traffic are checked to see if they match the established protocol behavior model, and situations that are inconsistent with normal behavior are identified.

9. A computer network communication security monitoring method according to claim 8, characterized in that: Perform real-time filtering and deep inspection of incoming and outgoing data packets to identify whether the data packets contain threats, including the following steps: Capture incoming and outgoing data packets, obtain detailed information about the data packets, including source address, destination address, protocol type, and data size, and use network packet capture tools or firewall devices to intercept data packets passing through network devices; Use firewalls or intrusion detection systems to filter incoming and outgoing data packets in real time based on source address, destination address, and protocol information. Use deep packet inspection tools to perform deep parsing on data packets that pass real-time filtering to further analyze the content and structure of data packets, including data payload and protocol header. Use malicious code scanning engines and intrusion detection systems to detect whether there are malicious features in data packets, including malicious code and attack signatures, perform feature matching on data packets to identify whether they contain known malicious features, analyze the behavior in data packets, and detect whether there are abnormal behaviors.

10. A computer network communication security monitoring system, used to implement the monitoring method according to any one of claims 1 to 9, characterized in that: It includes traffic monitoring module, judgment module, VPN monitoring module, data packet monitoring module, detection module, communication interruption module, secondary analysis module and quality analysis module; Traffic monitoring module: Before communication, it detects whether there is abnormal traffic in the computer network based on the algorithm of time series pattern recognition, and identifies whether there are outliers in the traffic data through the Grubbs detection algorithm; Judgment module: if there is no abnormal traffic and the traffic data has no outliers, it prompts that the computer network supports communication, and wakes up the VPN monitoring module, the data packet monitoring module and the detection module; VPN monitoring module: During the communication process, it monitors VPN connections based on protocol analysis algorithms to identify potential anomalies in VPN communications; Packet monitoring module: performs real-time filtering and deep detection of incoming and outgoing communication packets to identify whether there are threats in the packets; Detection module: detects whether there are outliers in the VPN connection mode through the Grubbs detection algorithm, and detects whether there are outliers in the data packet through the Grubbs detection algorithm; Communication interruption module: If there is communication anomaly detected, including abnormal network traffic, potential VPN communication anomaly, data packet threat or outlier, the communication interruption will be directly controlled; Secondary analysis module: If there is no communication anomaly in the monitoring, the traffic data, VPN connection and data packet are obtained by calculating the G value through the Grubbs detection algorithm, and a communication assignment is generated after weighted calculation of multiple G values. The corresponding control strategy is generated based on the comparison result between the communication assignment and the gradient anomaly threshold; Quality analysis module: After the communication is completed, the average communication value and the communication interruption frequency during the communication process are calculated through a polynomial algorithm, and the communication quality is analyzed. The analysis results are sent to the administrator and database storage for subsequent analysis.

Images