Network security monitoring system based on internal and external network separation

Abstract

The invention discloses a network security monitoring system based on internal and external network separation, which relates to the field of network security monitoring and comprises a management center in communication connection with a data acquisition module, an internal and external analysis module, a real-time monitoring module and a network maintenance module. The data acquisition module acquires network operation flow data and network element flow data to generate screen pair flow data, and the internal and external analysis module acquires a network building environment generated by the screen pair flow data according to the screen pair flow data to generate internal and external abnormal data and environment distribution data. The real-time monitoring module obtains intrusion flow data and normal flow data according to the internal and external abnormal data and the environment distribution data, and constructs a network prevention and control diagram according to the intrusion flow data and the normal flow data, and the network maintenance module carries out network maintenance on positions with hidden dangers of network security according to the network prevention and control diagram. The relevance of internal and external network synchronous management is improved, and the internal and external network security is improved.

Description

Technical Field

[0001] The invention relates to the field of network security monitoring, in particular to a network security monitoring system based on separation of internal and external networks. Background Art

[0002] In today's era of rapid development of informatization, information security has become one of the important issues that enterprises cannot ignore. In order to protect sensitive data and systems within the enterprise, an effective information security solution is provided: internal and external network separation. Internal and external network separation refers to the establishment of two completely independent networks within the enterprise, divided into internal and external networks. By separating the internal and external networks, the risk of external attacks on internal systems can be reduced and the level of information security can be improved.

[0003] However, in the existing internal and external network separation technology, the boundary between the internal and external networks is vague and unclear, which reduces the accuracy of network security problem monitoring. In addition, during the process of data exchange between the internal and external networks, they may be attacked, causing network security problems, resulting in unclear abnormal data of network security monitoring. For this reason, a network security monitoring system based on internal and external network separation is provided. Summary of the invention

[0004] In order to solve the above technical problems, the object of the present invention is to provide a network security monitoring system based on internal and external network separation, including a management center, the management center is communicatively connected with a data acquisition module, an internal and external analysis module, a real-time monitoring module and a network maintenance module;

[0005] The data collection module is used to collect network operation flow data and network element flow data, compare and filter the network operation flow data and the network element flow data, and then generate filter flow data;

[0006] The internal and external analysis module is used to obtain the network environment generated by the screen flow data according to the screen flow data, and analyze the network environment and the screen flow data to generate internal and external abnormal data and environmental distribution data;

[0007] The real-time monitoring module is used to locate the network fault location according to the internal and external abnormal data and the environmental distribution data, obtain the intrusion flow data and the normal flow data, and build a network prevention and control map according to the intrusion flow data and the normal flow data;

[0008] The network maintenance module is used to perform network maintenance at locations where potential network security risks exist according to the network prevention and control map.

[0009] Furthermore, the process of the data collection module collecting network operation flow data and network element flow data includes:

[0010] The network operation flow data includes intranet operation flow data and extranet operation flow data; the intranet operation flow data includes intranet operation flow, intranet operation flow rate and intranet timestamp; the extranet operation flow data includes extranet operation flow, extranet operation flow rate and extranet timestamp;

[0011] The network element flow data includes internal network element flow data and external network element flow data; the internal network element flow data includes internal network element flow and internal network element information; the external network element flow data includes external network element flow and external network element information;

[0012] Establish internal and external network separation system;

[0013] The internal and external network separation system includes an internal network subsystem, an external network subsystem and a firewall subsystem;

[0014] The intranet subsystem includes an intranet center and an intranet operation node, and an intranet monitoring point is set in the intranet center and the intranet operation node;

[0015] The external network subsystem includes an external network center and an external network operation node, and the external network center and the external network operation node are provided with an external network monitoring point;

[0016] The firewall subsystem is provided with an internal defense unit, an external defense unit and an internal-external joint defense unit;

[0017] Based on the intranet monitoring points and extranet monitoring points, network operation flow data and network meta-flow data are collected in real time.

[0018] Furthermore, the data collection module compares and screens the network operation flow data and the network element flow data, and then generates the screened flow data in the following process:

[0019] According to the internal network element flow and the external network element flow, the internal network operation flow data and the external network operation flow data are filtered respectively;

[0020] If the intranet element flow is consistent with the intranet operation network flow or the extranet element flow is consistent with the extranet operation network flow, the intranet operation flow data and the extranet operation flow data are respectively marked with the intranet element and the extranet element, and the intranet unit code and the extranet unit code are obtained according to the intranet element information and the extranet element information, and the intranet data of the screened flow is obtained according to the intranet unit code and the transmission data passing through the intranet monitoring point, and the extranet data of the screened flow is obtained according to the extranet unit code and the transmission data passing through the extranet monitoring point, and the screened flow data includes the intranet data of the screened flow and the extranet data of the screened flow;

[0021] If the internal network element flow and the internal network operation flow or the external network element flow and the external network operation flow are inconsistent, obtain the internal network operation node through which the internal network element flow passes or the external network operation node through which the external network element flow passes, and record the internal network operation node as the internal network control node, and record the external network operation node as the external network control node.

[0022] Furthermore, the internal and external analysis module obtains the network environment generated by the screening flow data according to the screening flow data, and analyzes the network environment and the screening flow data to generate the internal and external abnormal data. The process includes:

[0023] The network creation environment is the transmission data in the internal and external network separation system and the location information of the monitoring points;

[0024] According to the intranet unit code in the intranet data of the screened flow and the external network unit code in the external network data of the screened flow, the intranet monitoring point and the external network monitoring point passed by the data transmission process are obtained, which are recorded as the path intranet monitoring point and the path external network monitoring point respectively, and the inner diameter state value is obtained according to the intranet timestamp and the intranet transportation network flow rate, and the outer diameter state value is obtained according to the external network timestamp and the intranet transportation network flow rate;

[0025] Set the path state threshold;

[0026] According to the inner diameter state value, the outer diameter state value and the diameter state threshold, the transmission process of the transmission data in the inner network subsystem and the outer network subsystem is analyzed respectively, and the inner network monitoring point of the path in the normal state or the abnormal state and the outer network monitoring point of the path in the normal state or the abnormal state are obtained respectively;

[0027] According to the inner diameter state value, the outer diameter state value, the positioning information of the inner network monitoring points of the path in the abnormal state and the normal state, and the positioning information of the outer network monitoring points of the path in the abnormal state and the normal state, the internal and external abnormal state data are obtained.

[0028] Furthermore, the internal and external analysis module creates an environment based on the network and analyzes the traffic data to generate the environment distribution data, including:

[0029] According to the intranet monitoring points on the path, the intranet timestamps of the intranet monitoring points on the path, the extranet monitoring points on the path, the extranet timestamps of the extranet monitoring points on the path, the positioning information of the intranet monitoring points on the path and the positioning information of the extranet monitoring points on the path, the transmission relationship between the intranet monitoring points on the path, the positioning information of the intranet monitoring points on the path, the transmission relationship between the extranet monitoring points on the path and the positioning information of the extranet monitoring points on the path are obtained, and the transmission relationship between the intranet monitoring points on the path, the positioning information of the intranet monitoring points on the path, the transmission relationship between the extranet monitoring points on the path and the positioning information of the extranet monitoring points on the path are recorded as environmental distribution data.

[0030] Furthermore, the real-time monitoring module monitors network security in real time according to the internal and external abnormal data and the environmental distribution data, and the process of obtaining the intrusion flow data and the normal flow data includes:

[0031] Obtain intrusion traffic data based on the positioning information of the intranet monitoring point of the path in abnormal state, the intranet transport network flow rate and inner diameter state value corresponding to the intranet monitoring point of the path in abnormal state, and the positioning information of the extranet monitoring point of the path in abnormal state, the extranet transport network flow rate and outer diameter state value corresponding to the extranet monitoring point of the path in abnormal state;

[0032] Normal traffic data is obtained by associating the positioning information of the internal network monitoring points of the path in normal state with the internal network transportation network flow rate corresponding to the internal network monitoring points of the path in normal state, as well as the positioning information of the external network monitoring points of the path in normal state with the external network transportation network flow rate corresponding to the external network monitoring points of the path in normal state.

[0033] Furthermore, the process of the real-time monitoring module constructing a network prevention and control map according to the intrusion traffic data and the normal traffic data includes:

[0034] According to the transmission relationship between the intranet monitoring points of the path between the abnormal state and the normal state of the environmental distribution data, and the extranet monitoring points of the path between the abnormal state and the normal state, and according to the positioning information, inner diameter state value and outer diameter state value of the monitoring points corresponding to the intrusion traffic data, the corresponding monitoring points are marked and colored red. According to the positioning information of the monitoring points corresponding to the normal traffic data, the corresponding monitoring points are marked green, and the intranet control nodes and the extranet control nodes are marked yellow. A network prevention and control map is constructed based on the link relationship, intrusion traffic data, normal traffic data, red monitoring points, yellow monitoring points and green monitoring points.

[0035] Furthermore, the network maintenance module is used to implement network maintenance at locations where potential network security risks exist according to the network prevention and control map, and the process includes:

[0036] Conduct network security analysis based on the inner diameter state value of the red path intranet monitoring point and the inner diameter state value of the red path extranet monitoring point;

[0037] If the inner diameter state value of the red path intranet monitoring point is equal to the inner diameter state value of the red path extranet monitoring point, the positioning information of the red path intranet monitoring point and the red path extranet monitoring point is sent to the internal and external joint defense unit, indicating that the data exchange between the intranet and the extranet is abnormal, and network security maintenance is performed on the data exchange between the intranet subsystem and the extranet subsystem;

[0038] If the inner diameter state value of the red path intranet monitoring point is not equal to the inner diameter state value of the red path external network monitoring point, the positioning information of the red path intranet monitoring point is sent to the internal defense unit to perform network security maintenance on the intranet subsystem, and the positioning information of the red path external network monitoring point is sent to the external defense unit to perform network security maintenance on the external network subsystem;

[0039] The location information corresponding to the yellow monitoring points in the network prevention and control map is sent to network maintenance personnel for network security inspection.

[0040] Compared with the prior art, the beneficial effects of the present invention are: collecting network operation flow data and network element flow data, comparing and screening the network operation flow data and the network element flow data, and then generating screened flow data, performing preliminary flow judgment on the intranet operation nodes and the extranet nodes, strictly controlling network security issues, obtaining the network creation environment generated by the screened flow data according to the screened flow data, and analyzing the network creation environment and the screened flow data, and then generating internal and external abnormal data and environmental distribution data, performing network security analysis on the intranet and the extranet respectively, monitoring abnormal data, and monitoring network security in real time, accurately locating the network fault location according to the internal and external abnormal data and the environmental distribution data, improving network security monitoring efficiency and maintenance efficiency, obtaining intrusion flow data and normal flow data, constructing a network prevention and control map according to the intrusion flow data and the normal flow data, improving the security monitoring efficiency of the internal and external networks, and implementing network maintenance at locations where network security risks exist according to the network prevention and control map, improving the monitoring efficiency of network security anomalies, improving the pertinence and efficiency of network security maintenance, and improving the network security and management relevance between intranets. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a schematic diagram of a network security monitoring system based on separation of internal and external networks according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] like Figure 1 As shown, a network security monitoring system based on separation of internal and external networks includes a management center, and the management center is communicatively connected with a data acquisition module, an internal and external analysis module, a real-time monitoring module and a network maintenance module;

[0043] The data collection module is used to collect network operation flow data and network element flow data, compare and filter the network operation flow data and the network element flow data, and then generate filter flow data;

[0044] The internal and external analysis module is used to obtain the network environment generated by the screen flow data according to the screen flow data, and analyze the network environment and the screen flow data to generate internal and external abnormal data and environmental distribution data;

[0045] The real-time monitoring module is used to locate the network fault location according to the internal and external abnormal data and the environmental distribution data, obtain the intrusion flow data and the normal flow data, and build a network prevention and control map according to the intrusion flow data and the normal flow data;

[0046] The network maintenance module is used to perform network maintenance on locations where potential network security risks exist according to the network prevention and control map;

[0047] It should be further explained that, in the specific implementation process, the data collection module is used to collect network operation flow data and network element flow data, and the process of comparing and screening the network operation flow data and the network element flow data to generate the screened flow data includes:

[0048] The network operation flow data includes intranet operation flow data and extranet operation flow data; the intranet operation flow data includes intranet operation flow, intranet operation flow rate and intranet timestamp; the extranet operation flow data includes extranet operation flow, extranet operation flow rate and extranet timestamp;

[0049] It should be further explained that, in the specific implementation process, the intranet transport network flow rate is obtained by the ratio of the intranet transport network flow rate to time, and the external network transport network flow rate is obtained by the ratio of the external network transport network flow rate to time;

[0050] The network element flow data includes internal network element flow data and external network element flow data; the internal network element flow data includes internal network element flow and internal network element information; the external network element flow data includes external network element flow and external network element information;

[0051] It should be further explained that, in the specific implementation process, network operation traffic data refers to the traffic-related data of the network during the transmission operation process, and network meta-traffic data refers to the initial traffic-related data generated by the network;

[0052] Establish internal and external network separation system;

[0053] The internal and external network separation system includes an internal network subsystem, an external network subsystem and a firewall subsystem;

[0054] The internal network subsystem and the external network subsystem are respectively connected to the firewall subsystem;

[0055] The intranet subsystem includes an intranet center and an intranet operation node, and an intranet monitoring point is set in the intranet center and the intranet operation node;

[0056] The external network subsystem includes an external network center and an external network operation node, and the external network center and the external network operation node are provided with an external network monitoring point;

[0057] The firewall subsystem is provided with an internal defense unit, an external defense unit and an internal-external joint defense unit;

[0058] The internal defense unit is used to manage the internal network subsystem; the external defense unit is used to manage the external network subsystem; the internal and external joint defense unit is used to manage the data access between the internal network subsystem and the external network subsystem, and the network maintenance personnel manage the internal defense unit, the external defense unit and the internal and external joint defense unit in real time;

[0059] It should be further explained that, in the specific implementation process, the intranet center in the intranet subsystem is the intranet data sending and receiving center, and is connected to the intranet operation node. The intranet subsystem includes a number of intranet operation nodes, and the intranet operation nodes are interconnected to serve the intranet center and transmit intranet data. The external network center in the external network subsystem is the external network data sending and receiving center, and is connected to the external network operation node. The external network subsystem includes a number of external network operation nodes, and the external network operation nodes are interconnected to serve the external network center and transmit external network data.

[0060] An intranet monitoring point is set in the intranet center and the intranet operation node of the intranet subsystem, and an extranet monitoring point is set in the extranet center and the extranet operation node of the extranet subsystem. Based on the intranet monitoring point and the extranet monitoring point, network operation flow data and network meta-flow data are collected in real time;

[0061] It should be further explained that, in the specific implementation process, the intranet monitoring point of the intranet center and the external network monitoring point of the external network center are used to collect the intranet element flow data and the external network element flow data respectively, and the intranet monitoring point of the intranet operation node and the external network monitoring point of the external network operation node are used to collect the intranet operation flow data and the external network operation flow data respectively;

[0062] The intranet operation flow data and the extranet operation flow data are screened respectively by the intranet element flow and the extranet element flow. If the intranet element flow is consistent with the intranet operation network flow, the intranet operation flow data is marked with the intranet element, and the intranet element information is converted into a binary code. The c-bit binary code in the binary code is randomly selected and recorded as the intranet unit code, and the transmission data corresponding to the intranet element flow passing through the intranet monitoring point is obtained, and the intranet unit code is inserted into the transmission data passing through the intranet monitoring point to obtain the screened intranet data of the flow and the screened extranet data of the flow;

[0063] If the intranet element flow is inconsistent with the intranet operation network flow, there is no need to mark the intranet element, and obtain the intranet operation node through which the intranet element flow passes, and record the intranet operation node as the intranet control node;

[0064] It should be further explained that, in the specific implementation process, the process of screening the external network operation flow data through the external network element flow includes: if the external network element flow is consistent with the external network operation network flow, the external network operation flow data is marked with the external network element, the external network element information is converted into a binary code, and the c-bit binary code in the binary code is randomly selected and recorded as the external network unit code, and the transmission data corresponding to the internal network element flow passing through the internal network monitoring point is obtained, and the external network unit code is inserted into the transmission data passing through the external network monitoring point to obtain the screened flow external network data, if the external network element flow is inconsistent with the external network operation network flow, there is no need to perform the external network element marking, and the external network operation node through which the external network element flow passes is obtained, and the internal network operation node is recorded as the external network control node;

[0065] The screen flow data includes screen flow intranet data and screen flow extranet data.

[0066] It should be further explained that, in the specific implementation process, the internal and external analysis module is used to obtain the network environment generated by the screen flow data according to the screen flow data, and analyze the network environment and the screen flow data to generate the internal and external abnormal data and the environmental distribution data. The process includes:

[0067] The network creation environment is the transmission data in the internal and external network separation system and the location information of the monitoring points;

[0068] Conduct internal transmission analysis on intranet data within the screen traffic data;

[0069] According to the intranet unit code in the intranet data of the screen flow, the transmission data passing through the intranet monitoring point is tracked, and the intranet monitoring points passed by the data transmission process are obtained, which are recorded as the path intranet monitoring points. According to the time sequence of the intranet timestamps and the intranet transportation network flow rate, the data transmission process is analyzed, and the difference of the intranet transportation network flow rates of the adjacent path intranet monitoring points is calculated, and the difference between the maximum difference and the minimum difference is recorded as the inner diameter state value;

[0070] Set the path state threshold;

[0071] When the inner diameter state value is less than or equal to the diameter state threshold, it means that the transmission process of the transmission data in the intranet subsystem is normal, and the path intranet monitoring point is marked as normal;

[0072] When the inner diameter state value is greater than the diameter state threshold, it indicates that the transmission process of the transmission data in the intranet subsystem is abnormal, and the path intranet monitoring point is marked as abnormal;

[0073] Conduct internal transmission analysis on the extranet data of the screen traffic within the screen traffic data;

[0074] According to the external network unit code in the external network data of the screening flow, the transmission data passing through the external network monitoring point is tracked, and the external network monitoring points passed by the data transmission process are obtained, which are recorded as the path external network monitoring points. According to the time sequence of the external network timestamps and the external network transportation network flow rate, the data transmission process is analyzed, and the difference of the external network transportation network flow rates of adjacent path external network monitoring points is calculated, and the difference between the maximum difference and the minimum difference is recorded as the external diameter state value;

[0075] When the external diameter state value is less than or equal to the diameter state threshold, it means that the transmission process of the transmission data in the external network subsystem is normal, and the path external network monitoring point is marked as normal;

[0076] When the external diameter state value is greater than the diameter state threshold, it indicates that the transmission process of the transmission data in the external network subsystem is abnormal, and the path external network monitoring point is marked as abnormal;

[0077] The inner diameter state value, the outer diameter state value, the location information of the inner network monitoring points of the path in the abnormal state and the normal state, and the location information of the outer network monitoring points of the path in the abnormal state and the normal state are packaged to obtain the inner and outer abnormal state data;

[0078] The positioning information of the intranet monitoring points and the extranet monitoring points of the path are obtained. According to the intranet monitoring points and the corresponding intranet timestamps in the intranet monitoring points, the extranet monitoring points and the corresponding extranet timestamps in the extranet monitoring points, the transmission path of the transmission data is restored by the time sequence of the intranet timestamps corresponding to the same transmission data and the time sequence of the extranet timestamps respectively, and according to the positioning information of the intranet monitoring points and the extranet monitoring points, the transmission relationship between the intranet monitoring points, the positioning information of the intranet monitoring points, the transmission relationship between the extranet monitoring points and the positioning information of the extranet monitoring points are obtained. The transmission relationship between the intranet monitoring points, the positioning information of the intranet monitoring points, the transmission relationship between the extranet monitoring points and the positioning information of the extranet monitoring points are sorted internally and externally respectively to obtain environmental distribution data.

[0079] It should be further explained that, in the specific implementation process, the real-time monitoring module is used to monitor network security in real time based on internal and external abnormal data and environmental distribution data, obtain intrusion traffic data and normal traffic data, and the process of constructing a network prevention and control map based on the intrusion traffic data and normal traffic data includes:

[0080] Analyze the internal and external abnormal data, respectively obtain the internal network flow rate of the internal network monitoring point of the path in the abnormal state and the external network flow rate of the path in the abnormal state in the internal and external abnormal data, and respectively obtain the positioning information of the internal network monitoring point of the path in the abnormal state and the positioning information of the external network monitoring point of the path in the abnormal state according to the environmental distribution data, associate the positioning information of the internal network monitoring point of the path in the abnormal state and the internal network flow rate corresponding to the internal network monitoring point of the path in the abnormal state with the internal diameter state value, associate the positioning information of the external network monitoring point of the path in the abnormal state and the external network flow rate corresponding to the external network monitoring point of the path in the abnormal state with the external diameter state value, and obtain the intrusion flow data;

[0081] Respectively obtain the internal network transportation network flow rate of the internal network monitoring point of the path in the normal state and the external network transportation network flow rate of the external network monitoring point of the path in the normal state in the internal and external abnormal data, and respectively obtain the positioning information of the internal network monitoring point of the path in the normal state and the positioning information of the external network monitoring point of the path in the normal state according to the environmental distribution data, associate the positioning information of the internal network monitoring point of the path in the normal state with the internal network transportation network flow rate corresponding to the internal network monitoring point of the path in the normal state, and associate the positioning information of the external network monitoring point of the path in the normal state with the external network transportation network flow rate corresponding to the external network monitoring point of the path in the normal state, to obtain normal flow data;

[0082] Combined with the positioning information between the intranet monitoring points of the path between the abnormal state and the normal state and the extranet monitoring points of the path between the abnormal state and the normal state, according to the environmental distribution data, the transmission relationship between the intranet monitoring points of the path between the abnormal state and the normal state and the extranet monitoring points of the path between the abnormal state and the normal state is obtained, and according to the positioning information, inner diameter state value and outer diameter state value of the monitoring point corresponding to the intrusion flow data, the corresponding monitoring point is marked, the inner diameter state value or outer diameter state value corresponding to the monitoring point is marked in the corresponding monitoring point, and the corresponding monitoring point is marked in red, according to the positioning information of the monitoring point corresponding to the normal flow data, the corresponding monitoring point is marked in green, and the intranet control node and the extranet control node are marked in yellow; and a network prevention and control map is constructed according to the transmission relationship, intrusion flow data, normal flow data, red monitoring points, yellow monitoring points and green monitoring points;

[0083] It should be further explained that, in the specific implementation process, the red monitoring points include the red path intranet monitoring points and the red extranet monitoring points, and the green monitoring points include the green path intranet monitoring points and the green extranet monitoring points;

[0084] Conduct real-time network monitoring of network operation traffic data and network meta-traffic data based on the network prevention and control map, and update the network prevention and control map in real time.

[0085] It should be further explained that, in the specific implementation process, the network maintenance module is used to implement network maintenance at locations where network security risks exist according to the network prevention and control map, including:

[0086] Analyze the red monitoring points in the network prevention and control map;

[0087] Obtain intrusion traffic data of the red path intranet monitoring point and the red path extranet monitoring point, and perform network security analysis based on the inner diameter state value of the red path intranet monitoring point and the inner diameter state value of the red path extranet monitoring point;

[0088] If the inner diameter state value of the red path intranet monitoring point is equal to the inner diameter state value of the red path extranet monitoring point, the positioning information of the red path intranet monitoring point and the red path extranet monitoring point is sent to the internal and external joint defense unit, indicating that the data exchange between the intranet and the extranet is abnormal, and network security maintenance is performed on the data exchange between the intranet subsystem and the extranet subsystem;

[0089] If the inner diameter state value of the red path intranet monitoring point is not equal to the inner diameter state value of the red path external network monitoring point, the positioning information of the red path intranet monitoring point is sent to the internal defense unit to perform network security maintenance on the intranet subsystem, and the positioning information of the red path external network monitoring point is sent to the external defense unit to perform network security maintenance on the external network subsystem;

[0090] The location information corresponding to the yellow monitoring points in the network prevention and control map is sent to network maintenance personnel for network security inspection.

[0091] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network security monitoring system based on separation of internal and external networks, including a management center, characterized in that: The management center is communicatively connected with a data acquisition module, an internal and external analysis module, a real-time monitoring module and a network maintenance module; The data collection module is used to collect network operation flow data and network element flow data, compare and filter the network operation flow data and the network element flow data, and then generate filter flow data; The internal and external analysis module is used to obtain the network environment generated by the screen flow data according to the screen flow data, and analyze the network environment and the screen flow data to generate internal and external abnormal data and environmental distribution data; The real-time monitoring module is used to locate the network fault location according to the internal and external abnormal data and the environmental distribution data, obtain the intrusion flow data and the normal flow data, and build a network prevention and control map according to the intrusion flow data and the normal flow data; The network maintenance module is used to perform network maintenance at locations where potential network security risks exist according to the network prevention and control map.

2. A network security monitoring system based on internal and external network separation according to claim 1, characterized in that: The process of the data collection module collecting network operation flow data and network element flow data includes: The network operation flow data includes intranet operation flow data and extranet operation flow data; the intranet operation flow data includes intranet operation flow, intranet operation flow rate and intranet timestamp; the extranet operation flow data includes extranet operation flow, extranet operation flow rate and extranet timestamp; The network element flow data includes internal network element flow data and external network element flow data; the internal network element flow data includes internal network element flow and internal network element information; the external network element flow data includes external network element flow and external network element information; Establish internal and external network separation system; The internal and external network separation system includes an internal network subsystem, an external network subsystem and a firewall subsystem; The intranet subsystem includes an intranet center and an intranet operation node, and an intranet monitoring point is set in the intranet center and the intranet operation node; The external network subsystem includes an external network center and an external network operation node, and the external network center and the external network operation node are provided with an external network monitoring point; The firewall subsystem is provided with an internal defense unit, an external defense unit and an internal-external joint defense unit; Based on the intranet monitoring points and extranet monitoring points, network operation flow data and network meta-flow data are collected in real time.

3. A network security monitoring system based on separation of internal and external networks according to claim 2, characterized in that: The data collection module compares and screens the network operation flow data and the network element flow data, and then generates the screened flow data in the following process: According to the internal network element flow and the external network element flow, the internal network operation flow data and the external network operation flow data are filtered respectively; If the intranet element flow is consistent with the intranet operation network flow or the extranet element flow is consistent with the extranet operation network flow, the intranet operation flow data and the extranet operation flow data are respectively marked with the intranet element and the extranet element, and the intranet unit code and the extranet unit code are obtained according to the intranet element information and the extranet element information, and the intranet data of the screened flow is obtained according to the intranet unit code and the transmission data passing through the intranet monitoring point, and the extranet data of the screened flow is obtained according to the extranet unit code and the transmission data passing through the extranet monitoring point, and the screened flow data includes the intranet data of the screened flow and the extranet data of the screened flow; If the internal network element flow and the internal network operation flow or the external network element flow and the external network operation flow are inconsistent, obtain the internal network operation node through which the internal network element flow passes or the external network operation node through which the external network element flow passes, and record the internal network operation node as the internal network control node, and record the external network operation node as the external network control node.

4. A network security monitoring system based on internal and external network separation according to claim 3, characterized in that: The internal and external analysis module obtains the network environment generated by the screen flow data according to the screen flow data, analyzes the network environment and the screen flow data, and then generates the internal and external abnormal data. The process includes: The network creation environment is the transmission data in the internal and external network separation system and the location information of the monitoring points; According to the intranet unit code in the intranet data of the screened flow and the external network unit code in the external network data of the screened flow, the intranet monitoring point and the external network monitoring point passed by the data transmission process are obtained, which are recorded as the path intranet monitoring point and the path external network monitoring point respectively, and the inner diameter state value is obtained according to the intranet timestamp and the intranet transportation network flow rate, and the outer diameter state value is obtained according to the external network timestamp and the intranet transportation network flow rate; Set the path state threshold; According to the inner diameter state value, the outer diameter state value and the diameter state threshold, the transmission process of the transmission data in the inner network subsystem and the outer network subsystem is analyzed respectively, and the inner network monitoring point of the path in the normal state or the abnormal state and the outer network monitoring point of the path in the normal state or the abnormal state are obtained respectively; According to the inner diameter state value, the outer diameter state value, the positioning information of the inner network monitoring points of the path in the abnormal state and the normal state, and the positioning information of the outer network monitoring points of the path in the abnormal state and the normal state, the internal and external abnormal state data are obtained.

5. A network security monitoring system based on separation of internal and external networks according to claim 4, characterized in that: The process in which the internal and external analysis module analyzes the traffic data according to the network environment and the screening, and then generates the environment distribution data includes: According to the intranet monitoring points on the path, the intranet timestamps of the intranet monitoring points on the path, the extranet monitoring points on the path, the extranet timestamps of the extranet monitoring points on the path, the positioning information of the intranet monitoring points on the path and the positioning information of the extranet monitoring points on the path, the transmission relationship between the intranet monitoring points on the path, the positioning information of the intranet monitoring points on the path, the transmission relationship between the extranet monitoring points on the path and the positioning information of the extranet monitoring points on the path are obtained, and the transmission relationship between the intranet monitoring points on the path, the positioning information of the intranet monitoring points on the path, the transmission relationship between the extranet monitoring points on the path and the positioning information of the extranet monitoring points on the path are recorded as environmental distribution data.

6. A network security monitoring system based on separation of internal and external networks according to claim 5, characterized in that: The real-time monitoring module monitors network security in real time based on internal and external abnormal data and environmental distribution data, and the process of obtaining intrusion flow data and normal flow data includes: Obtain intrusion traffic data based on the positioning information of the intranet monitoring point of the path in abnormal state, the intranet transport network flow rate and inner diameter state value corresponding to the intranet monitoring point of the path in abnormal state, and the positioning information of the extranet monitoring point of the path in abnormal state, the extranet transport network flow rate and outer diameter state value corresponding to the extranet monitoring point of the path in abnormal state; Normal traffic data is obtained by associating the positioning information of the internal network monitoring points of the path in normal state with the internal network transportation network flow rate corresponding to the internal network monitoring points of the path in normal state, as well as the positioning information of the external network monitoring points of the path in normal state with the external network transportation network flow rate corresponding to the external network monitoring points of the path in normal state.

7. A network security monitoring system based on separation of internal and external networks according to claim 6, characterized in that: The process of the real-time monitoring module constructing a network prevention and control map based on the intrusion traffic data and the normal traffic data includes: According to the transmission relationship between the intranet monitoring points of the path between the abnormal state and the normal state of the environmental distribution data, and the extranet monitoring points of the path between the abnormal state and the normal state, and according to the positioning information, inner diameter state value and outer diameter state value of the monitoring points corresponding to the intrusion traffic data, the corresponding monitoring points are marked and colored red. According to the positioning information of the monitoring points corresponding to the normal traffic data, the corresponding monitoring points are marked green, and the intranet control nodes and the extranet control nodes are marked yellow. A network prevention and control map is constructed based on the link relationship, intrusion traffic data, normal traffic data, red monitoring points, yellow monitoring points and green monitoring points.

8. A network security monitoring system based on separation of internal and external networks according to claim 7, characterized in that: The network maintenance module is used to implement network maintenance at locations where network security risks exist according to the network prevention and control map. The process includes: Conduct network security analysis based on the inner diameter state value of the red path intranet monitoring point and the inner diameter state value of the red path extranet monitoring point; If the inner diameter state value of the red path intranet monitoring point is equal to the inner diameter state value of the red path extranet monitoring point, the positioning information of the red path intranet monitoring point and the red path extranet monitoring point is sent to the internal and external joint defense unit, indicating that the data exchange between the intranet and the extranet is abnormal, and network security maintenance is performed on the data exchange between the intranet subsystem and the extranet subsystem; If the inner diameter state value of the red path intranet monitoring point is not equal to the inner diameter state value of the red path external network monitoring point, the positioning information of the red path intranet monitoring point is sent to the internal defense unit to perform network security maintenance on the intranet subsystem, and the positioning information of the red path external network monitoring point is sent to the external defense unit to perform network security maintenance on the external network subsystem; The location information corresponding to the yellow monitoring points in the network prevention and control map is sent to network maintenance personnel for network security inspection.

Images