Network security monitoring method and system

Abstract

The invention relates to a network security monitoring method and system, and relates to the technical field of network security. When to-be-monitored network flow data is obtained, a target monitoring node is determined from a plurality of monitoring nodes, then a target monitoring rule is determined by using historical monitoring data, including historical network flow data, historical monitoring information and historical monitoring rules, of the target monitoring node, and then the network flow data is monitored through the target monitoring node according to the target monitoring rule. And determining whether the to-be-monitored network traffic data is abnormal network traffic data. According to the technical scheme, the network flow data needing to be monitored and the corresponding monitoring nodes and monitoring rules can be adjusted according to actual conditions, dynamic monitoring of the adaptive network flow data is achieved, and therefore the accuracy of monitoring information can be improved, the reliability and stability of network security event monitoring can be improved, and the security of network data is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular, to a network security monitoring method and system. Background Art

[0002] With the development of the Internet and communication technologies, network security issues have also arisen. In various scenarios, in order to ensure data security, it is usually necessary to monitor network security events. In the monitoring scenario of network security events, the common means currently used is to locate abnormal network traffic data based on network traffic data and use rule judgment. In this monitoring method, fixed rules are used and cannot cope with various scenarios, which results in low data security. Summary of the invention

[0003] The purpose of the present disclosure is to provide a network security monitoring method and system, which can improve the accuracy of monitoring information, improve the reliability and stability of network security monitoring, and thus improve the security of network data.

[0004] In order to achieve the above-mentioned objectives, in a first aspect, the present disclosure provides a network security monitoring method, comprising: in response to obtaining network traffic data to be monitored, determining a target monitoring node from multiple monitoring nodes; obtaining historical network traffic data monitored by the target monitoring node, historical monitoring information corresponding to the historical network traffic data, and historical monitoring rules, the historical monitoring information being used to characterize whether the historical network traffic data is abnormal network traffic data; determining a target monitoring rule based on the historical network traffic data, the historical monitoring information, and the historical monitoring rules; determining, through the target monitoring node, the target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rule, the target monitoring information being used to characterize whether the network traffic data to be monitored is abnormal network traffic data.

[0005] Optionally, the multiple monitoring nodes correspond to different node addresses respectively, the network traffic data to be monitored is the network traffic data transmitted by the target interface, the network data to be monitored carries the interface address corresponding to the target interface, and determining the target monitoring node from the multiple monitoring nodes includes: determining a first monitoring node from the multiple monitoring nodes according to the node addresses and the interface addresses respectively corresponding to the multiple monitoring nodes; determining a second monitoring node having a transmission link with the first monitoring node from the monitoring nodes other than the first monitoring node; and determining the target monitoring node according to the first monitoring node and the second monitoring node.

[0006] Optionally, determining a first monitoring node from the multiple monitoring nodes based on the node addresses and the interface addresses respectively corresponding to the multiple monitoring nodes includes: for any monitoring node among the multiple monitoring nodes, determining the similarity between the node address corresponding to the monitoring node and the interface address, and using the similarity as the address matching degree corresponding to the monitoring node; determining a third monitoring node having an address matching degree higher than a preset matching degree from the multiple monitoring nodes based on the address matching degrees respectively corresponding to the multiple monitoring nodes; determining first address information related to a data transmission protocol from the node address corresponding to the third monitoring node; determining second address information related to a data transmission protocol from the interface address; determining the first monitoring node from the third monitoring node based on the first address information and the second address information corresponding to the third monitoring node.

[0007] Optionally, determining the target monitoring rules based on the historical network traffic data, the historical monitoring information and the historical monitoring rules includes: determining abnormal network traffic data and normal network traffic data from the historical network traffic data based on the historical monitoring information; determining the target monitoring rules based on the historical monitoring rules corresponding to the abnormal network traffic data and the historical monitoring rules corresponding to the normal network traffic data.

[0008] Optionally, determining the target monitoring rule according to the historical monitoring rules corresponding to the abnormal network traffic data and the historical monitoring rules corresponding to the normal network traffic data includes: determining a first monitoring rule according to the historical monitoring rules corresponding to the abnormal network traffic data; determining a second monitoring rule according to the historical monitoring rules corresponding to the normal network traffic data; determining reference network traffic data according to the abnormal network traffic data and the normal network traffic data; determining, through a test node, first reference monitoring information corresponding to the reference network traffic data according to the first monitoring rule, the first reference monitoring information being used to characterize whether the reference network traffic data is abnormal network traffic data; determining, through a test node, second reference monitoring information corresponding to the reference network traffic data according to the second monitoring rule, the second reference monitoring information being used to characterize whether the reference network traffic data is abnormal network traffic data; determining a target monitoring rule from the first monitoring rule and the second monitoring rule according to the first reference monitoring information and the second reference monitoring information.

[0009] Optionally, determining the reference network traffic data based on the abnormal network traffic data and the normal network traffic data includes: determining the data similarity between the abnormal network traffic data and the normal network traffic data; determining a data selection ratio between the abnormal network traffic data and the normal network traffic data based on the data similarity; selecting network traffic data to be combined from the abnormal network traffic data and the normal network traffic data based on the data selection ratio; and combining the network traffic data to be combined to obtain the reference network traffic data.

[0010] Optionally, any one of the historical monitoring rules and the target monitoring rules includes: network traffic data features that need to be extracted for the network traffic data to be monitored and rules for determining monitoring information based on the extracted network traffic data features, wherein the method for determining monitoring information based on the extracted network traffic data features includes: at least one of rules based on traffic features, rules based on behavior patterns, rules based on protocol compliance, and rules based on machine learning algorithms.

[0011] Optionally, the monitoring method also includes: if the target monitoring information characterizes that the network traffic data to be monitored is abnormal network traffic data, performing exception processing on the network traffic data to be monitored according to the target monitoring rules through the target monitoring node; if the target monitoring information characterizes that the network traffic data to be monitored is normal network traffic data, transmitting the network traffic data to be monitored to a corresponding data receiving node through the target monitoring node according to the target monitoring rules.

[0012] Optionally, the monitoring method also includes: in response to detecting that the target monitoring node fails to determine the target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rule, determining the target monitoring information corresponding to the network traffic data to be monitored according to the alternative monitoring rule by an alternative monitoring node; and storing the network traffic data to be monitored, the target monitoring information corresponding to the network traffic data to be monitored, and the alternative monitoring rule as historical information associated with the target monitoring node.

[0013] In a second aspect, the present disclosure provides a network security monitoring system, comprising: multiple monitoring nodes; a monitoring gateway, which is communicatively connected to the multiple monitoring nodes respectively, and the monitoring gateway is configured to: in response to obtaining the network traffic data to be monitored, determine a target monitoring node from the multiple monitoring nodes; obtain historical network traffic data monitored by the target monitoring node, historical monitoring information corresponding to the historical network traffic data, and historical monitoring rules, the historical monitoring information being used to characterize whether the historical network traffic data is abnormal network traffic data; determine the target monitoring rules based on the historical network traffic data, the historical monitoring information and the historical monitoring rules; determine the target monitoring information corresponding to the network traffic data to be monitored through the target monitoring node according to the target monitoring rules, and the target monitoring information is used to characterize whether the network traffic data to be monitored is abnormal network traffic data.

[0014] Through the above technical solution, when the network traffic data to be monitored is obtained, the target monitoring node is first determined from multiple monitoring nodes, and then the target monitoring rule is determined using the historical monitoring data of the target monitoring node, including historical network traffic data, historical monitoring information and historical monitoring rules, and then the target monitoring node is used to determine whether the network traffic data to be monitored is abnormal network traffic data according to the target monitoring rule. For the network traffic data to be monitored, the corresponding monitoring nodes and monitoring rules can be adjusted according to the actual situation to achieve dynamic monitoring of adaptive network traffic data, thereby improving the accuracy of monitoring information, improving the reliability and stability of network security monitoring, and thus improving the security of network data.

[0015] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0017] Figure 1 The invention is a block diagram of a network security monitoring system according to an exemplary embodiment.

[0018] Figure 2 The diagram is a schematic diagram of operation logic of a monitoring system according to an exemplary embodiment.

[0019] Figure 3 The present invention is a flowchart of a network security monitoring method according to an exemplary embodiment.

[0020] Figure 4is a structural block diagram of yet another monitoring system according to an exemplary embodiment.

[0021] Figure 5 is a schematic diagram of operation logic of another monitoring system according to an exemplary embodiment.

[0022] Figure 6 The present invention is a block diagram of a device for monitoring network security events according to an exemplary embodiment.

[0023] Figure 7 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0024] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0025] With the development of the Internet and communication technologies, network security issues have also arisen. In various scenarios, network security monitoring is usually required to ensure data security. In the monitoring scenario of network security events, the common method currently used is to locate abnormal network traffic data based on network traffic data and rule judgment. In this monitoring method, fixed rules are used and cannot cope with various scenarios, which results in low data security.

[0026] Based on this, the embodiment of the present disclosure provides a technical solution. When the network traffic data to be monitored is obtained, the target monitoring node is first determined from multiple monitoring nodes, and then the target monitoring rule is determined using the historical monitoring data of the target monitoring node, including historical network traffic data, historical monitoring information and historical monitoring rules, and then the target monitoring node is used to determine whether the network traffic data to be monitored is abnormal network traffic data according to the target monitoring rule. For the network traffic data to be monitored, the corresponding monitoring nodes and monitoring rules can be adjusted according to the actual situation to achieve dynamic monitoring of adaptive network traffic data, thereby improving the accuracy of monitoring information, improving the reliability and stability of network security event monitoring, and thus improving the security of network data.

[0027] Figure 1 is a block diagram of a network security event monitoring system according to an exemplary embodiment. Figure 1 As shown, the monitoring system includes: multiple monitoring nodes and a monitoring gateway.

[0028] In different scenarios, the monitoring system can have different forms. For example, in an Internet scenario, multiple monitoring nodes can be multiple servers deployed by the Internet system to monitor abnormal traffic, and the monitoring gateway can be a control gateway deployed for multiple servers, which is responsible for integrating the monitoring information of multiple monitoring nodes, and then determining whether there are abnormal network events in the Internet system.

[0029] Figure 2 is a schematic diagram of an operation logic of a monitoring system according to an exemplary embodiment. Figure 2 As shown, multiple monitoring nodes have the function of monitoring abnormal traffic respectively, but the operation of these multiple monitoring nodes is controlled by the monitoring gateway. On the one hand, the monitoring network can dynamically allocate monitoring nodes for traffic monitoring according to the network traffic data to be monitored. On the other hand, the monitoring network can dynamically configure monitoring rules for each monitoring node so that the monitoring rules of each monitoring node can adapt to the changing data.

[0030] In addition to being applicable to Internet scenarios, the monitoring system can also be applied to various communication networks, or to other scenarios involving network traffic data, which are not limited here.

[0031] Figure 3 FIG. 1 is a flow chart of a network security monitoring method according to an exemplary embodiment, and the monitoring method can be applied to the aforementioned monitoring gateway. Figure 3 As shown, the monitoring method comprises the following steps:

[0032] Step S31, in response to obtaining the network traffic data to be monitored, determining a target monitoring node from a plurality of monitoring nodes.

[0033] Step S32, obtaining the historical network traffic data monitored by the target monitoring node, the historical monitoring information corresponding to the historical network traffic data, and the historical monitoring rules, wherein the historical monitoring information is used to characterize whether the historical network traffic data is abnormal network traffic data.

[0034] Step S33, determining target monitoring rules based on historical network traffic data, historical monitoring information and historical monitoring rules.

[0035] Step S34, determining target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rule through the target monitoring node, where the target monitoring information is used to characterize whether the network traffic data to be monitored is abnormal network traffic data.

[0036] In some embodiments, the monitoring system may be configured with multiple data interfaces, which are respectively used to obtain network traffic data from different data sources. Therefore, the network traffic data to be monitored may be the network traffic data received by the data interface currently required to be monitored.

[0037] Based on the network traffic data to be monitored, a target monitoring node may be first determined from multiple monitoring nodes.

[0038] As an optional implementation, the plurality of monitoring nodes correspond to different node addresses respectively, and the network flow data to be monitored is the network flow data transmitted by the target interface, wherein the target interface is a data interface for receiving the network flow data to be monitored.

[0039] In this embodiment, each of the plurality of monitoring nodes is also assigned a network address, which can be used as its node address.

[0040] Correspondingly, step S31 may include: determining a first monitoring node from multiple monitoring nodes based on node addresses and interface addresses corresponding to the multiple monitoring nodes respectively; determining a second monitoring node having a transmission link with the first monitoring node from monitoring nodes other than the first monitoring node; and determining a target monitoring node based on the first monitoring node and the second monitoring node.

[0041] In some embodiments, a first monitoring node is determined from multiple monitoring nodes based on node addresses and interface addresses respectively corresponding to the multiple monitoring nodes, including: for any monitoring node among the multiple monitoring nodes, determining the similarity between the node address and the interface address corresponding to the monitoring node, and using the similarity as the address matching degree corresponding to the monitoring node; based on the address matching degrees respectively corresponding to the multiple monitoring nodes, determining a third monitoring node having an address matching degree higher than a preset matching degree from the multiple monitoring nodes; determining first address information related to a data transmission protocol from the node address corresponding to the third monitoring node; determining second address information related to a data transmission protocol from the interface address; determining the first monitoring node from the third monitoring node based on the first address information and the second address information corresponding to the third monitoring node.

[0042] In some embodiments, both the node address and the interface address are constructed by characters, that is, the node address and the interface address can be regarded as different character strings. Therefore, the similarity between the node address and the interface address can be calculated according to the calculation method of the character string similarity. The higher the similarity between the node address and the interface address, the higher the probability that the address type is the same, and the higher the probability that the communication protocol is the same.

[0043] It can be understood that the similarity can be regarded as a kind of address matching degree. The higher the address matching degree, the higher the stability and reliability of data transmission between the interface and the monitoring node. Furthermore, since the data transmitted through the interface needs to be transmitted to the monitoring node in the end, the monitoring node that can improve the stability and reliability of data transmission can be selected based on the address matching degree.

[0044] Therefore, a third monitoring node having an address matching degree higher than a preset matching degree can be determined from the multiple monitoring nodes in priority according to the address matching degrees respectively corresponding to the multiple monitoring nodes.

[0045] In some embodiments, the preset matching degree can be determined based on the complexity of the communication protocol involved in allocating addresses in the monitoring system, the complexity of the data encryption algorithm, etc. For example, the higher the complexity of the communication protocol, the higher the complexity of the data encryption algorithm, the higher the diversity of the representative address, and the preset matching degree can be lower, for example, about 50%. The lower the complexity of the communication protocol, the lower the complexity of the data encryption algorithm, the lower the diversity of the representative address, and the preset matching degree can be lower, for example, about 70%.

[0046] Furthermore, after the third monitoring node is preliminarily screened out, the address information may be further compared.

[0047] The address information may be address information related to a data transmission protocol. Specifically, the address information may be a character or a string representing the data transmission protocol.

[0048] It can be understood that when configuring the address, the monitoring system can add characters or strings corresponding to the data transmission protocol (communication protocol) to the address of each hardware, and the characters or strings can be located at a fixed address position, such as: the middle or end of a string of addresses. Therefore, through the pre-configured address configuration method, the address information related to the data transmission protocol can be quickly located from the address.

[0049] Furthermore, the above-mentioned address information is extracted respectively for the interface address and the node address corresponding to the third monitoring node, so as to obtain the first address information and the second address information.

[0050] Further, according to the first address information and the second address information, the first monitoring node can be determined from the third monitoring nodes.

[0051] In some embodiments, the third monitoring node corresponding to the first address information that is the same as the second address information is preferentially determined as the first monitoring node. That is, the monitoring node with the same data transmission protocol as the data transmission protocol of the data interface is preferentially determined as the first monitoring node. If there are multiple monitoring nodes with the same data transmission protocol, the node with the current smaller load can be preferentially selected as the first monitoring node.

[0052] In some embodiments, if a third monitoring node corresponding to the first address information identical to the second address information is not found, a monitoring node with a lower data transmission protocol conversion difficulty can be determined as the first monitoring node based on a preconfigured data transmission protocol conversion difficulty.

[0053] Regarding the difficulty of data transmission protocol conversion, it can be characterized by the difficulty of conversion between different data transmission protocols, such as: the difficulty of data compression, data decompression, data encryption, data decryption and other related data conversion methods.

[0054] Furthermore, after the first monitoring node is determined, a second monitoring node having a transmission link with the first monitoring node may be determined from the remaining monitoring nodes.

[0055] It can be understood that in the monitoring system, data transmission links may also be configured between different monitoring nodes. However, data transmission links may be configured only between monitoring nodes with low data transmission costs.

[0056] Therefore, based on the first monitoring node and the second monitoring node, the load of the monitoring node and the historical monitoring data of the monitoring node can be compared, and the monitoring node with a smaller load and more historical monitoring data can be preferentially selected as the target monitoring node.

[0057] In some embodiments, if the target monitoring node is a first monitoring node, then when data monitoring is performed through the target monitoring node, data can be directly transmitted to the target monitoring node. If the target monitoring node is a second monitoring node, then when data monitoring is performed through the target monitoring node, data can be first transmitted to the first monitoring node with which the data transmission link is established, and then the data is transmitted to the target monitoring node through the first monitoring node.

[0058] In step S32, historical network traffic data monitored by the target monitoring node, historical monitoring information corresponding to the historical network traffic data, and historical monitoring rules are obtained, and the historical monitoring information is used to characterize whether the historical network traffic data is abnormal network traffic data.

[0059] In some embodiments, historical network traffic data, historical monitoring information corresponding to the historical network traffic data, and historical monitoring rules may be obtained from each monitoring node at intervals and stored locally. Therefore, historical data may be obtained locally.

[0060] In some embodiments, various historical data may also be obtained from each monitoring node when needed.

[0061] In some embodiments, multiple monitoring rules may be configured in each monitoring node. In the early stage of monitoring, monitoring may be performed according to fixed rules. In the later stage, as the amount of data increases, a method of dynamically selecting monitoring rules may be adopted.

[0062] Therefore, in step S33, target monitoring rules are determined based on historical network traffic data, historical monitoring information and historical monitoring rules.

[0063] As an optional implementation, step S33 includes: determining abnormal network traffic data and normal network traffic data from historical network traffic data based on historical monitoring information; determining target monitoring rules based on historical monitoring rules corresponding to abnormal network traffic data and historical monitoring rules corresponding to normal network traffic data.

[0064] In some embodiments, the historical monitoring rules corresponding to abnormal network traffic data and the historical monitoring rules corresponding to normal network traffic data can be compared, and the historical monitoring rules with higher frequency of occurrence can be determined as the target monitoring rules. Alternatively, the monitoring rules with higher frequency of occurrence and corresponding to abnormal network traffic data can be determined as the target monitoring rules.

[0065] In some embodiments, target monitoring rules are determined based on historical monitoring rules corresponding to abnormal network traffic data and historical monitoring rules corresponding to normal network traffic data, including: determining a first monitoring rule based on historical monitoring rules corresponding to abnormal network traffic data; determining a second monitoring rule based on historical monitoring rules corresponding to normal network traffic data; determining reference network traffic data based on abnormal network traffic data and normal network traffic data; determining first reference monitoring information corresponding to the reference network traffic data through a test node according to the first monitoring rule, the first reference monitoring information being used to characterize whether the reference network traffic data is abnormal network traffic data; determining second reference monitoring information corresponding to the reference network traffic data through a test node according to the second monitoring rule, the second reference monitoring information being used to characterize whether the reference network traffic data is abnormal network traffic data; determining a target monitoring rule from the first monitoring rule and the second monitoring rule based on the first reference monitoring information and the second reference monitoring information.

[0066] In some embodiments, the monitoring rule with the highest occurrence frequency among the historical monitoring rules corresponding to the abnormal network traffic data may be determined as the first monitoring rule, and the monitoring rule with the lowest occurrence frequency among the historical monitoring rules corresponding to the normal network traffic data may be determined as the second monitoring rule.

[0067] In some embodiments, reference network traffic data is determined based on abnormal network traffic data and normal network traffic data, including: determining the data similarity between the abnormal network traffic data and the normal network traffic data; determining the data selection ratio between the abnormal network traffic data and the normal network traffic data based on the data similarity; selecting network traffic data to be combined from the abnormal network traffic data and the normal network traffic data based on the data selection ratio; and combining the network traffic data to be combined to obtain reference network traffic data.

[0068] In this implementation, if the data similarity is high, the proportion of abnormal network traffic data and normal network traffic data in the data selection ratio is close. If the data similarity is low, the proportion of abnormal network traffic data in the data selection ratio is higher than the proportion of normal network traffic data.

[0069] For example, if the data similarity is higher than 90%, the data selection ratio may be 1:1. If the data similarity is lower than 90% and higher than 50%, the data selection ratio may be 0.7:0.3. If the data similarity is lower than 50%, the data selection ratio may be 0.8:0.2.

[0070] Furthermore, based on the data selection ratio, corresponding network traffic data are selected from the abnormal network traffic data and the normal network traffic data respectively as the network traffic data to be combined.

[0071] Furthermore, the network traffic data to be combined are combined to obtain reference network traffic data.

[0072] In some embodiments, when combining network traffic data, data from different network traffic data may be integrated into the same format and then spliced ​​into new data to obtain reference network traffic data.

[0073] Further, through the test node, according to the first monitoring rule, the first reference monitoring information corresponding to the reference network traffic data is determined, and the first reference monitoring information is used to characterize whether the reference network traffic data is abnormal network traffic data. And, through the test node, according to the second monitoring rule, the second reference monitoring information corresponding to the reference network traffic data is determined, and the second reference monitoring information is used to characterize whether the reference network traffic data is abnormal network traffic data.

[0074] The test node may be a node pre-configured in the monitoring system for testing monitoring rules, which is adapted to various monitoring rules. Through the test node, monitoring is performed according to the first monitoring rule and the second monitoring rule respectively to obtain corresponding monitoring information.

[0075] Furthermore, according to the first reference monitoring information and the second reference monitoring information, a target monitoring rule is determined from the first monitoring rule and the second monitoring rule.

[0076] In some embodiments, the corresponding monitoring information is preferentially selected as the monitoring rule that characterizes abnormal network traffic data as the target monitoring rule. If the corresponding monitoring information all characterizes abnormal network traffic data, a simpler monitoring rule is selected, or a monitoring rule with higher accuracy is selected, or a monitoring rule that matches the current load of the target monitoring node is selected. For example, if the load is high, a monitoring rule with lower difficulty is selected. If the load is low, a monitoring rule with higher accuracy is selected, etc.

[0077] Through this implementation, the adaptability of the target monitoring node to different monitoring rules can be tested, and then a monitoring rule that is more suitable for the target monitoring node can be determined.

[0078] In the embodiments of the present disclosure, the monitoring rules involved may include: network traffic data features that need to be extracted for the network traffic data to be monitored and rules for determining monitoring information based on the extracted network traffic data features, wherein the method for determining monitoring information based on the extracted network traffic data features includes: at least one of rules based on traffic features, rules based on behavior patterns, rules based on protocol compliance, and rules based on machine learning algorithms.

[0079] The network traffic data features may be specific character strings, data features determined by analyzing the data, etc., and may be specifically referred to mature rule configuration methods in the art.

[0080] Regarding rules based on traffic features, traffic features can be used to determine whether the data is abnormal network traffic data. Regarding rules based on behavior patterns, corresponding behavior patterns can be used to determine whether the data is abnormal network traffic data. Regarding rules based on protocol compliance, whether the data is abnormal network traffic data can be determined by whether the corresponding protocol is compliant. Regarding rules based on machine learning algorithms, models based on machine learning algorithms can be used to determine whether the data is abnormal network traffic data based on features. For details, various mature network traffic anomaly determination rules in the field can be used.

[0081] In some embodiments, the monitoring rule can also be understood as a monitoring algorithm, or other interpretations, which are not limited here.

[0082] Furthermore, the target monitoring rules and the network traffic data to be monitored can be synchronized to the target monitoring node, so that the target monitoring node can determine the target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rules to determine whether the network traffic data to be monitored is abnormal network traffic data.

[0083] Furthermore, the monitoring method may also include: if the target monitoring information indicates that the network traffic data to be monitored is abnormal network traffic data, performing abnormal processing on the network traffic data to be monitored according to the target monitoring rules through the target monitoring node; if the target monitoring information indicates that the network traffic data to be monitored is normal network traffic data, transmitting the network traffic data to be monitored to the corresponding data receiving node through the target monitoring node according to the target monitoring rules.

[0084] In this implementation, the target monitoring node may also have the ability to process abnormal network traffic. Therefore, when the target monitoring information indicates that the network traffic data to be monitored is abnormal network traffic data, the target monitoring node may directly perform abnormal processing on the network traffic data to be monitored according to the target monitoring rule.

[0085] For example, different monitoring rules can be pre-configured with different exception handling methods. Based on the target monitoring rule, the corresponding exception handling method can be determined.

[0086] For example, when the monitoring rules include: network traffic data features to be extracted for the network traffic data to be monitored, processing can be performed based on the features identified as abnormal network traffic data features, for example, deleting these data features, converting these data features, etc.

[0087] In some embodiments, when the network traffic data to be monitored is normal network traffic data, the target monitoring node may transmit the network traffic data to be monitored to the corresponding data receiving node according to the target monitoring rule.

[0088] In this embodiment, when the monitoring rules include: for the network traffic data features to be extracted from the network traffic data to be monitored, the features identified as normal network data features can be encrypted and then transmitted to the data receiving node. Alternatively, other means based on the target monitoring rules can be used to improve the transmission security accordingly to achieve data synchronization.

[0089] In some embodiments, the monitoring method may also include: in response to detecting that the target monitoring node fails to determine the target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rules, determining the target monitoring information corresponding to the network traffic data to be monitored according to the alternative monitoring rules through the alternative monitoring node; storing the network traffic data to be monitored, the target monitoring information corresponding to the network traffic data to be monitored, and the alternative monitoring rules as historical information associated with the target monitoring node.

[0090] In this implementation, considering the target monitoring node, there is a possibility of monitoring failure, so this situation can be handled.

[0091] In some embodiments, if the target monitoring node fails to determine the target monitoring information within a preset time period, it is determined that the monitoring has failed. Alternatively, if the target monitoring node feeds back information indicating a monitoring error, it is determined that the monitoring has failed.

[0092] In the monitoring system, alternative monitoring nodes can also be configured, and the alternative monitoring nodes are adapted to alternative monitoring rules. The alternative monitoring rules can be the most reliable and stable monitoring rules, and the monitoring rules will be continuously updated. Thus, by using the alternative monitoring nodes, the target monitoring information corresponding to the network traffic data to be monitored can be determined according to the alternative monitoring rules.

[0093] Furthermore, the network traffic data to be monitored, the target monitoring information corresponding to the network traffic data to be monitored, and the candidate monitoring rules can be stored as historical information associated with the target monitoring node. Thus, when the target monitoring node is subsequently monitored, the historical information can be applied.

[0094] Figure 4 is a structural block diagram of another monitoring system according to an exemplary embodiment. Figure 4 As shown, in Figure 1 On the basis of the monitoring system shown, the monitoring system is further configured with a test node and an alternative monitoring node. The test node and the alternative monitoring node can improve the reliability and stability of the entire monitoring system through the corresponding functions introduced in the aforementioned embodiments.

[0095] Figure 5 is a schematic diagram of another operation logic of a monitoring system according to an exemplary embodiment. Figure 5 As shown, in Figure 2 Based on the operation logic shown, the test node can also be used to assist in determining the target monitoring rule, and the alternative monitoring node can be used to handle the situation where the target monitoring node fails to monitor.

[0096] Figure 6 is a block diagram of a network security event monitoring device 600 according to an exemplary embodiment. Figure 6 As shown, the monitoring device comprises:

[0097] The determination module 601 is used to determine a target monitoring node from multiple monitoring nodes in response to obtaining the network traffic data to be monitored.

[0098] The acquisition module 602 is used to acquire the historical network traffic data monitored by the target monitoring node, the historical monitoring information corresponding to the historical network traffic data, and the historical monitoring rules, wherein the historical monitoring information is used to characterize whether the historical network traffic data is abnormal network traffic data.

[0099] The determination module 601 is further configured to determine a target monitoring rule based on the historical network traffic data, the historical monitoring information and the historical monitoring rule.

[0100] The determination module 601 is also used to determine the target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rule through the target monitoring node, and the target monitoring information is used to characterize whether the network traffic data to be monitored is abnormal network traffic data.

[0101] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0102] Figure 7 FIG. 7 is a block diagram of an electronic device 700 according to an exemplary embodiment. Figure 7 As shown, the electronic device 700 may include: a processor 701 and a memory 702. The electronic device 700 may also include one or more of a multimedia component 703, an input / output (I / O) interface 704, and a communication component 705.

[0103] The processor 701 is used to control the overall operation of the electronic device 700 to complete all or part of the steps in the above-mentioned network security event monitoring method. The memory 702 is used to store various types of data to support the operation of the electronic device 700, and these data may include, for example, instructions for any application or method used to operate on the electronic device 700, and application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk. The multimedia component 703 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone, which is used to receive external audio signals. The received audio signal may be further stored in the memory 702 or sent through the communication component 705. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 704 provides an interface between the processor 701 and other interface modules, and the above-mentioned other interface modules may be keyboards, mice, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 705 may include: Wi-Fi module, Bluetooth module, NFC module.

[0104] In an exemplary embodiment, the electronic device 700 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned network security event monitoring method.

[0105] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned network security event monitoring method are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 702 including program instructions, and the above-mentioned program instructions can be executed by the processor 701 of the electronic device 700 to complete the above-mentioned network security event monitoring method.

[0106] In another exemplary embodiment, a computer program product is further provided. The computer program product includes a computer program that can be executed by a processor. When the computer program is executed by the processor, the steps of the above-mentioned network security event monitoring method are implemented.

[0107] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0108] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0109] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A network security monitoring method, characterized in that: include: In response to acquiring the network traffic data to be monitored, determining a target monitoring node from a plurality of monitoring nodes; Acquire historical network traffic data monitored by the target monitoring node, historical monitoring information corresponding to the historical network traffic data, and historical monitoring rules, wherein the historical monitoring information is used to characterize whether the historical network traffic data is abnormal network traffic data; Determining target monitoring rules according to the historical network traffic data, the historical monitoring information and the historical monitoring rules; The target monitoring information corresponding to the network traffic data to be monitored is determined by the target monitoring node according to the target monitoring rule, and the target monitoring information is used to characterize whether the network traffic data to be monitored is abnormal network traffic data.

2. The monitoring method according to claim 1, characterized in that: The multiple monitoring nodes correspond to different node addresses respectively, the network traffic data to be monitored is network traffic data transmitted by a target interface, the network data to be monitored carries an interface address corresponding to the target interface, and determining the target monitoring node from the multiple monitoring nodes includes: Determine a first monitoring node from the plurality of monitoring nodes according to the node addresses and the interface addresses respectively corresponding to the plurality of monitoring nodes; Determine, from monitoring nodes other than the first monitoring node, a second monitoring node having a transmission link with the first monitoring node; A target monitoring node is determined according to the first monitoring node and the second monitoring node.

3. The monitoring method according to claim 2, characterized in that: The determining a first monitoring node from the plurality of monitoring nodes according to the node addresses and the interface addresses respectively corresponding to the plurality of monitoring nodes comprises: For any monitoring node among the multiple monitoring nodes, determine the similarity between the node address corresponding to the monitoring node and the interface address, and use the similarity as the address matching degree corresponding to the monitoring node; According to the address matching degrees respectively corresponding to the plurality of monitoring nodes, determining a third monitoring node having an address matching degree higher than a preset matching degree from the plurality of monitoring nodes; Determining first address information related to a data transmission protocol from a node address corresponding to the third monitoring node; Determining second address information related to a data transmission protocol from the interface address; The first monitoring node is determined from the third monitoring nodes according to the first address information and the second address information corresponding to the third monitoring node.

4. The monitoring method according to claim 1, characterized in that: The determining of target monitoring rules according to the historical network traffic data, the historical monitoring information and the historical monitoring rules includes: Determining abnormal network traffic data and normal network traffic data from the historical network traffic data according to the historical monitoring information; The target monitoring rule is determined according to the historical monitoring rule corresponding to the abnormal network traffic data and the historical monitoring rule corresponding to the normal network traffic data.

5. The monitoring method according to claim 4, characterized in that: The determining the target monitoring rule according to the historical monitoring rule corresponding to the abnormal network traffic data and the historical monitoring rule corresponding to the normal network traffic data includes: Determining a first monitoring rule according to the historical monitoring rule corresponding to the abnormal network traffic data; Determining a second monitoring rule according to the historical monitoring rule corresponding to the normal network traffic data; Determining reference network traffic data according to the abnormal network traffic data and the normal network traffic data; Determine, by the test node, first reference monitoring information corresponding to the reference network traffic data according to the first monitoring rule, wherein the first reference monitoring information is used to characterize whether the reference network traffic data is abnormal network traffic data; Determine, by the test node, second reference monitoring information corresponding to the reference network traffic data according to the second monitoring rule, where the second reference monitoring information is used to characterize whether the reference network traffic data is abnormal network traffic data; According to the first reference monitoring information and the second reference monitoring information, a target monitoring rule is determined from the first monitoring rule and the second monitoring rule.

6. The monitoring method according to claim 5, characterized in that: The determining of reference network traffic data according to the abnormal network traffic data and the normal network traffic data includes: Determining data similarity between the abnormal network traffic data and the normal network traffic data; Determining a data selection ratio between the abnormal network traffic data and the normal network traffic data according to the data similarity; According to the data selection ratio, selecting the network traffic data to be combined from the abnormal network traffic data and the normal network traffic data; The network traffic data to be combined are combined to obtain the reference network traffic data.

7. The monitoring method according to any one of claims 1 to 6, characterized in that: Any monitoring rule among the historical monitoring rules and the target monitoring rules includes: network traffic data features that need to be extracted for the network traffic data to be monitored and rules for determining monitoring information based on the extracted network traffic data features, wherein the method for determining monitoring information based on the extracted network traffic data features includes: at least one of rules based on traffic features, rules based on behavior patterns, rules based on protocol compliance and rules based on machine learning algorithms.

8. The monitoring method according to any one of claims 1 to 6, characterized in that: The monitoring method further comprises: If the target monitoring information indicates that the network traffic data to be monitored is abnormal network traffic data, performing abnormal processing on the network traffic data to be monitored according to the target monitoring rule by the target monitoring node; If the target monitoring information indicates that the network traffic data to be monitored is normal network traffic data, the target monitoring node transmits the network traffic data to be monitored to a corresponding data receiving node according to the target monitoring rule.

9. The monitoring method according to any one of claims 1 to 6, characterized in that: The monitoring method further comprises: In response to detecting that the target monitoring node fails to determine the target monitoring information corresponding to the network traffic data to be monitored according to the target monitoring rule, determining the target monitoring information corresponding to the network traffic data to be monitored according to the alternative monitoring rule by the alternative monitoring node; The network traffic data to be monitored, the target monitoring information corresponding to the network traffic data to be monitored, and the candidate monitoring rules are stored as historical information associated with the target monitoring node.

10. A network security monitoring system, characterized in that: include: Multiple monitoring nodes; A monitoring gateway is connected to the plurality of monitoring nodes for communication, and the monitoring gateway is configured as follows: In response to acquiring the network traffic data to be monitored, determining a target monitoring node from a plurality of monitoring nodes; Acquire historical network traffic data monitored by the target monitoring node, historical monitoring information corresponding to the historical network traffic data, and historical monitoring rules, wherein the historical monitoring information is used to characterize whether the historical network traffic data is abnormal network traffic data; Determining target monitoring rules according to the historical network traffic data, the historical monitoring information and the historical monitoring rules; The target monitoring information corresponding to the network traffic data to be monitored is determined by the target monitoring node according to the target monitoring rule, and the target monitoring information is used to characterize whether the network traffic data to be monitored is abnormal network traffic data.

Images