Online behavior blocking method and system based on network equipment

Abstract

The invention discloses an internet behavior blocking method and system based on network equipment, and the method comprises the steps: capturing internet behavior data through deploying a deep packet inspection technology in target network equipment; training a violation behavior analysis model according to the obtained historical violation external connection data set and the network security standard data set, and inputting the internet surfing behavior data into the trained violation behavior identification model to obtain a violation analysis result; in response to the violation analysis result, dynamically configuring corresponding blocking strategies on different hierarchies in a pre-constructed multi-level defense architecture according to an adaptive algorithm; and executing the configured blocking strategy, and flexibly and efficiently blocking illegal internet surfing behaviors in the target network equipment, thereby improving the security of network operation.

Description

Technical Field

[0001] The present invention relates to the technical field of network security management, and in particular to a method and system for blocking Internet access based on network equipment. Background Art

[0002] With the popularization of the Internet, people's work, life and study are increasingly dependent on the Internet. However, network security issues are also becoming increasingly prominent, such as the spread of malware, network attacks, and the spread of bad information. In order to ensure network security, it is necessary to manage and control online behavior.

[0003] At present, the existing methods for managing Internet behavior mainly include firewalls, intrusion detection systems, etc. However, since these technical means are relatively fixed and single, they lack flexibility in the blocking process and cannot adjust strategies in a timely manner, resulting in security risks in the process of network operation.

[0004] It can be seen that how to optimize and improve the Internet behavior blocking method and improve the security of network operation has become a technical problem that technical personnel in this field need to solve urgently. Summary of the invention

[0005] The present invention provides a method and system for blocking Internet access behavior based on network equipment, so as to solve the problem of how to effectively block illegal Internet access behavior targeting at network equipment and ensure the security of the network system.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a method for blocking Internet access behavior based on a network device, comprising:

[0007] Capture Internet behavior data by deploying deep packet inspection technology in target network devices;

[0008] Training a violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set, and inputting the online behavior data into the trained violation behavior recognition model to obtain a violation analysis result;

[0009] In response to the violation analysis results, dynamically configure corresponding blocking strategies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm;

[0010] The configured blocking strategy is executed to block the illegal Internet access behavior in the target network device.

[0011] Furthermore, the capturing of Internet behavior data by deploying deep packet inspection technology in the target network device includes:

[0012] Deploy deep packets in the target network device and configure corresponding capture rules, and combine network edge detection technology to capture the Internet behavior data in real time; and,

[0013] A monitoring agent is deployed in the terminal device to collect the online behavior data in real time.

[0014] Furthermore, the training of the violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set includes:

[0015] Collecting IP address information, website visit information, application usage information, and data transfer volume information from different network device logs to form the historical violation outreach data set;

[0016] Performing feature extraction on the historical illegal external connection data set and the network security standard data set to obtain a first data set;

[0017] Using principal component analysis technology to perform feature selection on the first data set to obtain a target violation data set;

[0018] The target violation data set is input into a selected neural network model for training to obtain the violation behavior analysis model.

[0019] Furthermore, in response to the violation analysis result, dynamically configuring corresponding blocking strategies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm includes:

[0020] In the multi-layered defense architecture, the functional characteristics of different layers facing illegal behaviors are analyzed; the multi-layered defense architecture is designed to include network layer, application layer and data layer

[0021] According to the functional characteristics, different blocking strategies are configured using the adaptive algorithm;

[0022] In response to the violation analysis result, the blocking strategy is dynamically adjusted; the blocking strategy includes the violation behavior type, triggering conditions and blocking measures.

[0023] Furthermore, the executing the configured blocking strategy to block the illegal Internet access behavior in the target network device includes:

[0024] In the process of executing the blocking strategy, corresponding alarm information is generated and sent to the user side;

[0025] Monitor the network blocking situation in real time, record logs, and generate blocking analysis reports;

[0026] According to the blocking analysis report, the blocking strategy is optimized accordingly.

[0027] Another embodiment of the present invention provides an Internet access behavior blocking system based on a network device, comprising:

[0028] A data capture module is used to capture Internet behavior data by deploying deep packet inspection technology in target network devices;

[0029] A behavior analysis module is used to train a violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set, and input the online behavior data into the trained violation behavior recognition model to obtain a violation analysis result;

[0030] A policy formulation module, for dynamically configuring corresponding blocking policies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm in response to the violation analysis results;

[0031] The policy execution module is used to execute the configured blocking policy to block illegal Internet access behaviors in the target network device.

[0032] Furthermore, the data capture module is specifically used to:

[0033] Deploy deep packets in the target network device and configure corresponding capture rules, and combine network edge detection technology to capture the Internet behavior data in real time; and,

[0034] A monitoring agent is deployed in the terminal device to collect the online behavior data in real time.

[0035] Furthermore, the construction of the illegal behavior analysis model includes:

[0036] Collecting IP address information, website visit information, application usage information, and data transfer volume information from different network device logs to form the historical violation outreach data set;

[0037] Performing feature extraction on the historical illegal external connection data set and the network security standard data set to obtain a first data set;

[0038] Using principal component analysis technology to perform feature selection on the first data set to obtain a target violation data set;

[0039] The target violation data set is input into a selected neural network model for training to obtain the violation behavior analysis model.

[0040] Furthermore, the strategy formulation module is specifically used to:

[0041] In the multi-layered defense architecture, the functional characteristics of different layers facing illegal behaviors are analyzed; the multi-layered defense architecture is designed to include network layer, application layer and data layer

[0042] According to the functional characteristics, different blocking strategies are configured using the adaptive algorithm;

[0043] In response to the violation analysis result, the blocking strategy is dynamically adjusted; the blocking strategy includes the violation behavior type, triggering conditions and blocking measures.

[0044] Furthermore, the policy execution module is specifically used to:

[0045] In the process of executing the blocking strategy, corresponding alarm information is generated and sent to the user side;

[0046] Monitor the network blocking situation in real time, record logs, and generate blocking analysis reports;

[0047] According to the blocking analysis report, the blocking strategy is optimized accordingly.

[0048] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0049] The present invention establishes a violation analysis model through data simulation and collection, and can perform real-time analysis on the acquired Internet behavior data, and formulate accurate blocking strategies based on the analysis results. Through the generated accurate blocking strategy, it can be adjusted according to actual needs. This active monitoring and analysis mechanism enables the system to achieve second-level blocking when illegal external connection behavior is detected, greatly improving the response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of the flow of a method for blocking Internet access behavior based on a network device in one embodiment of the present invention;

[0051] Figure 2 It is a schematic diagram of the structure of an Internet behavior blocking system based on network devices in one embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] In the description of this application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the feature. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0054] In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. The terms "vertical", "horizontal", "left", "right", "upper", "lower" and similar expressions used herein are only for illustrative purposes, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0055] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0056] An embodiment of the present invention provides a method for blocking Internet access based on a network device. For details, see Figure 1 , Figure 1 The figure shows a flow chart of a method for blocking Internet access behavior based on a network device in one embodiment of the present invention, comprising the following steps:

[0057] S1. Capture Internet behavior data by deploying deep packet inspection technology in target network devices.

[0058] Specifically, the embodiment of the present invention deploys deep packets in the target network device and configures corresponding capture rules, and combines network edge detection technology to capture the Internet behavior data in real time; and deploys a monitoring agent in the terminal device to collect the Internet behavior data in real time.

[0059] It is understandable that deploying deep packet inspection (DPI) technology in gateways or key network devices not only analyzes the metadata of network traffic, for example, such as source IP, destination IP, port number, etc., but also deeply parses the data packet content, identifies related protocols and specific content, such as keywords, URLs, file types, etc., so that the obtained Internet behavior data is more accurate and can fully and comprehensively reflect various types of violations that may occur in Internet behavior.

[0060] It is worth noting that the use of edge computing technology to conduct preliminary analysis near the source of data generation, such as at the edge of the network, can reduce data transmission delays and improve the response speed of subsequent violation analysis.

[0061] In some implementations of the present invention, corresponding network devices, such as routers or switches, need to be deployed in the network environment, and these devices need to have data capture and analysis capabilities.

[0062] Before inputting the online behavior data into the model for analysis, the configured network device can perform a preliminary analysis of the online behavior data. As an example, the captured data can be preprocessed first, such as removing duplicate data and filtering irrelevant information. Then, the configured data analysis algorithm can be selected to perform preliminary processing on the preprocessed data, such as counting access frequencies and identifying malicious propagation behaviors. In this process, the relevant data generated during the analysis process can be stored in the corresponding database for subsequent query and retrieval.

[0063] From the above analysis, it can be seen that in some embodiments of the present invention, a data analysis algorithm for network device configuration is provided, taking the DPI (deep packet inspection) algorithm as an example:

[0064] DP I_score=f(protoco l,port,packet_content)

[0065] The DPI algorithm identifies specific network applications or services by analyzing the protocol type, port number, and data content of network packets;

[0066] protocol represents the protocol type (such as HTTP, HTTPS and FTP);

[0067] port represents the port number;

[0068] packet_content represents a portion of the packet content;

[0069] DP I_score is a score used to indicate how well a data packet matches a specific application.

[0070] S2. Train a violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set, and input the online behavior data into the trained violation behavior recognition model to obtain a violation analysis result.

[0071] This step aims to train a violation analysis model to identify and analyze the violations in the captured online behavior data.

[0072] Specifically, IP address information, website access information, application usage information and data transmission volume information are collected from logs of different network devices to form the historical illegal external connection data set. It can be understood that the collected relevant information reflects the illegal behavior.

[0073] Feature extraction is performed on the historical illegal external connection data set and the network security standard data set to obtain a first data set. It is understandable that in some embodiments of the present invention, data features related to illegal external connections in the data set are extracted according to the definition and scope of illegal external connection behavior. As an example, the extracted features include the time, frequency, duration, source address, destination address, amount of data transmitted, etc. of the network connection.

[0074] In the process of feature selection, correlation coefficient analysis, information gain, principal component analysis and other techniques can be used to select the features that are most relevant to illegal external contact behaviors in order to improve the accuracy and efficiency of the model.

[0075] Preferably, the embodiment of the present invention uses principal component analysis technology to perform feature selection on the first data set, and finally constructs a target violation data set for training the model.

[0076] The target violation data set is input into the selected neural network model for training to obtain the violation behavior analysis model. It is worth noting that during the model training process, the embodiment of the present invention evaluates and optimizes the model through cross-validation and other methods, which can improve the accuracy and robustness of the model.

[0077] After obtaining the trained illegal behavior analysis model, the real-time collected online behavior data is input into the model, and the model will output the analysis results. It can be understood that in some embodiments of the present invention, the analysis results may include the following:

[0078] Identification of illegal external contact behaviors, such as the type of illegal behavior, the device entity and time that performed the illegal behavior, and the judgment of behavioral risks, such as data leakage risk and system security risk, etc. It also includes analysis of behavioral patterns, such as the frequency, development trend and correlation of illegal external contact behaviors.

[0079] S3. In response to the violation analysis result, dynamically configure corresponding blocking strategies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm.

[0080] It can be understood that the present invention designs a multi-level defense architecture including a network layer, an application layer, and a data layer, and integrates the trained violation behavior analysis model into the above multi-level defense architecture.

[0081] Since different layers of the designed architecture process Internet behavior data in different ways, in the multi-level defense architecture of this embodiment, it is necessary to analyze the functional characteristics of different layers with respect to illegal behaviors.

[0082] As an example, the constructed application layer can integrate the trained violation analysis model to realize the analysis and identification of violation in this layer. The network layer is set as the transmission layer of online behavior data, and the data layer is set as the layer for storing and processing data, including database, file system, data backup, etc.

[0083] According to the above functional characteristics, different blocking strategies are configured using the adaptive algorithm. It can be understood that in the face of different functional characteristics of different layers, the embodiment of the present invention uses an adaptive algorithm to configure different blocking strategy trigger mechanisms for each layer. As an example, at the network layer, IP blocking, port filtering, traffic monitoring and other measures can be configured. At the data layer, data encryption, access control, data desensitization and other measures can be configured. At the application layer, access to specific applications can be restricted, such as prohibiting access to certain unsafe websites or applications. Preferably, the embodiment of the present invention provides the following strategy for restricting access to websites:

[0084] 1. Determine the type of website or specific list of websites that need to be restricted;

[0085] 2. Establish clear Internet use policies and inform all users of the existence and reasons for these restrictions;

[0086] 3. Configure access control lists (ACLs) or website filtering rules on network firewalls or routers;

[0087] 4. Use content filtering software or services to identify and block objectionable website content

[0088] In response to the violation analysis results, the multiple layers are interconnected to timely trigger the dynamic adjustment of the blocking strategy. In some embodiments of the present invention, the configured blocking strategy includes the type of violation, trigger conditions, and blocking measures. Specifically, in actual application scenarios, before implementing the blocking strategy, it is necessary to conduct a strategy test in a test environment to ensure the effectiveness and security of the strategy, thereby preventing the erroneous blocking of legitimate Internet access behaviors.

[0089] S4. Execute the configured blocking strategy to block the illegal Internet access behavior in the target network device.

[0090] In the process of executing the blocking strategy, corresponding alarm information will be generated and sent to the user side. It can be understood that alarms or notifications will be sent to administrators or users in a timely manner during the blocking process, which will help administrators understand the security status of the network in real time.

[0091] Monitor the blocking situation of the network in real time and record logs, generate a blocking analysis report, and optimize the blocking strategy accordingly based on the blocking analysis report.

[0092] In the process of implementing restriction policies on websites, some embodiments of the present invention ensure the effectiveness of restriction policies by monitoring network traffic and user behavior, and regularly checking access control lists and filtering rules.

[0093] It can be understood that the embodiments of the present invention monitor the network in real time and evaluate the effectiveness of the strategy, including checking whether the blocking strategy works as expected and whether adjustment is needed. At the same time, the blocking strategy and related configuration information are documented and stored in the database of the network device, that is, related log files are generated for documentation and subsequent reference.

[0094] In summary, the embodiments of the present invention can improve the acquisition quality and analysis effect of online behavior data by collecting online behavior data after deploying network equipment; the online behavior data is input into the constructed illegal behavior analysis model for analysis and judgment, and the constructed analysis model can realize accurate analysis of the online behavior data, and at the same time can improve the efficiency of subsequent strategy formulation; the present invention also realizes the formulation of online behavior blocking strategies at different levels through a multi-level blocking architecture, which can effectively block online behaviors with illegal external connections in a targeted manner, thereby improving the security of network operation.

[0095] An embodiment of the present invention provides a network device-based Internet access blocking system. For details, see Figure 2 , Figure 2 The figure shows a schematic diagram of the structure of an Internet behavior blocking system based on a network device in one embodiment of the present invention, including:

[0096] The data capture module M1 is used to capture Internet behavior data by deploying deep packet inspection technology in the target network device;

[0097] The behavior analysis module M2 is used to train a violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set, and input the online behavior data into the trained violation behavior recognition model to obtain a violation analysis result;

[0098] A strategy formulation module M3, for dynamically configuring corresponding blocking strategies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm in response to the violation analysis result;

[0099] The policy execution module M4 is used to execute the configured blocking policy to block the illegal Internet access behavior in the target network device.

[0100] It can be understood that this embodiment deploys deep packets in the target network device and configures corresponding capture rules through the data capture module M1, and combines network edge detection technology to capture the Internet behavior data in real time; and deploys a monitoring agent in the terminal device to collect the Internet behavior data in real time.

[0101] Furthermore, this embodiment constructs the illegal behavior analysis model through the behavior analysis module M2, specifically:

[0102] Collecting IP address information, website visit information, application usage information, and data transfer volume information from different network device logs to form the historical violation outreach data set;

[0103] Performing feature extraction on the historical illegal external connection data set and the network security standard data set to obtain a first data set;

[0104] Using principal component analysis technology to perform feature selection on the first data set to obtain a target violation data set;

[0105] The target violation data set is input into a selected neural network model for training to obtain the violation behavior analysis model.

[0106] Furthermore, this embodiment formulates a corresponding blocking strategy through the strategy formulation module M3, and in the multi-level defense architecture, analyzes the functional characteristics of different levels for illegal behaviors; the multi-level defense architecture is designed to include a network layer, an application layer, and a data layer; according to the functional characteristics, different blocking strategies are configured using the adaptive algorithm; in response to the violation analysis results, the blocking strategy is triggered to be dynamically adjusted; the blocking strategy includes the type of illegal behavior, triggering conditions, and blocking measures.

[0107] Furthermore, this embodiment implements the blocking operation through the policy execution module M4. It can be understood that in the process of executing the blocking strategy, corresponding alarm information is generated and sent to the user side; the blocking situation of the network is monitored in real time and logs are recorded, and a blocking analysis report is generated; according to the blocking analysis report, the blocking strategy is optimized accordingly.

[0108] The technical features and technical effects of the Internet behavior blocking system based on network devices proposed in the embodiment of the present invention are the same as the technical features and technical effects of the Internet behavior blocking method based on network devices proposed in the embodiment of the present invention, and will not be repeated here.

[0109] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for blocking Internet access based on network equipment, characterized in that: include: Capture Internet behavior data by deploying deep packet inspection technology in target network devices; Training a violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set, and inputting the online behavior data into the trained violation behavior recognition model to obtain a violation analysis result; In response to the violation analysis results, dynamically configure corresponding blocking strategies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm; The configured blocking strategy is executed to block the illegal Internet access behavior in the target network device.

2. The method for blocking Internet access based on network equipment according to claim 1, characterized in that: The method captures Internet behavior data by deploying deep packet inspection technology in the target network device, including: Deploy deep packets in the target network device and configure corresponding capture rules, and combine network edge detection technology to capture the Internet behavior data in real time; and, A monitoring agent is deployed in the terminal device to collect the online behavior data in real time.

3. The method for blocking Internet access based on network equipment according to claim 1, characterized in that: The training of the violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set includes: Collecting IP address information, website visit information, application usage information, and data transfer volume information from different network device logs to form the historical violation outreach data set; Performing feature extraction on the historical illegal external connection data set and the network security standard data set to obtain a first data set; Using principal component analysis technology to perform feature selection on the first data set to obtain a target violation data set; The target violation data set is input into a selected neural network model for training to obtain the violation behavior analysis model.

4. The method for blocking Internet access based on network equipment according to claim 1, characterized in that: In response to the violation analysis result, dynamically configuring corresponding blocking strategies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm, including: In the multi-layered defense architecture, the functional characteristics of different layers facing illegal behaviors are analyzed; the multi-layered defense architecture is designed to include network layer, application layer and data layer According to the functional characteristics, different blocking strategies are configured using the adaptive algorithm; In response to the violation analysis result, the blocking strategy is dynamically adjusted; the blocking strategy includes the violation behavior type, triggering conditions and blocking measures.

5. The method for blocking Internet access based on network equipment according to claim 1, characterized in that: The executing the configured blocking strategy to block the illegal Internet access behavior in the target network device includes: In the process of executing the blocking strategy, corresponding alarm information is generated and sent to the user side; Monitor the network blocking situation in real time, record logs, and generate blocking analysis reports; According to the blocking analysis report, the blocking strategy is optimized accordingly.

6. A network device-based Internet behavior blocking system, characterized in that: include: A data capture module is used to capture Internet behavior data by deploying deep packet inspection technology in target network devices; A behavior analysis module is used to train a violation behavior analysis model based on the acquired historical violation external connection data set and network security standard data set, and input the online behavior data into the trained violation behavior recognition model to obtain a violation analysis result; A policy formulation module, for dynamically configuring corresponding blocking policies at different levels in a pre-built multi-level defense architecture according to an adaptive algorithm in response to the violation analysis results; The policy execution module is used to execute the configured blocking policy to block illegal Internet access behaviors in the target network device.

7. The Internet behavior blocking system based on network equipment according to claim 6, characterized in that: The data capture module is specifically used for: Deploy deep packets in the target network device and configure corresponding capture rules, and combine network edge detection technology to capture the Internet behavior data in real time; and, A monitoring agent is deployed in the terminal device to collect the online behavior data in real time.

8. The Internet access blocking system based on network equipment as claimed in claim 6, characterized in that: The construction of the violation analysis model includes: Collecting IP address information, website visit information, application usage information, and data transfer volume information from different network device logs to form the historical violation outreach data set; Performing feature extraction on the historical illegal external connection data set and the network security standard data set to obtain a first data set; Using principal component analysis technology to perform feature selection on the first data set to obtain a target violation data set; The target violation data set is input into a selected neural network model for training to obtain the violation behavior analysis model.

9. The Internet behavior blocking system based on network equipment according to claim 6, characterized in that: The strategy formulation module is specifically used for: In the multi-layered defense architecture, the functional characteristics of different layers facing illegal behaviors are analyzed; the multi-layered defense architecture is designed to include network layer, application layer and data layer According to the functional characteristics, different blocking strategies are configured using the adaptive algorithm; In response to the violation analysis result, the blocking strategy is dynamically adjusted; the blocking strategy includes the violation behavior type, triggering conditions and blocking measures.

10. The Internet access blocking system based on network equipment according to claim 6, characterized in that: The policy execution module is specifically used for: In the process of executing the blocking strategy, corresponding alarm information is generated and sent to the user side; Monitor the network blocking situation in real time, record logs, and generate blocking analysis reports; According to the blocking analysis report, the blocking strategy is optimized accordingly.

Images