A software runtime environment security monitoring system based on the Internet

Abstract

This invention discloses an internet-based software runtime environment security monitoring system. This invention relates to the field of software security technology and solves the problem that the lack of identification of characteristic traffic based on different historical traffic data generated by the corresponding software during its historical process hinders the comprehensiveness of software security monitoring. This invention, by performing interval analysis on historical traffic data, calculates the feature density of different processing intervals and compares them to determine the interval with the most obvious characteristics as the characteristic traffic interval. This method fully considers the distribution and changes in traffic data. Simultaneously, based on the characteristic traffic interval, it further determines the characteristic trend interval, which can comprehensively characterize the traffic characteristics during normal software operation, laying the foundation for accurate subsequent judgment of abnormal states.

Description

Technical Field

[0001] This invention relates to the field of software security technology, specifically to an Internet-based software runtime environment security monitoring system. Background Technology

[0002] In today's digital age, software has become an indispensable part of various business and life scenarios; however, the complexity and openness of the software operating environment have brought about many security risks; software operating environment security supervision aims to ensure that software runs in a safe and stable environment and protect the integrity, confidentiality and availability of data and systems through a series of technical and management measures.

[0003] Patent application CN114968761B discloses an internet-based software runtime environment security monitoring system, relating to the field of software environment security monitoring technology. It solves the technical problem in existing technologies that cannot accurately analyze the defects caused by the current runtime environment to software operation and match appropriate repair methods. The system can perform runtime environment analysis during software operation and obtain real-time defects, thereby improving software operating efficiency. Simultaneously, it performs real-time runtime analysis when defects occur, and rationally selects the current defect repair method through real-time analysis, thus improving the efficiency of current software repair and preventing unreasonable repair methods from reducing software operating efficiency. It also judges the intensity of the current analysis object's operation, thereby improving the accuracy of repair method selection and reducing the impact of runtime defects without affecting the operating efficiency of the analyzed object.

[0004] During the security monitoring of the corresponding software's operating environment, abnormal traffic is generally confirmed based on preset traffic ranges to identify whether there are security issues in the software's operating environment. However, in actual operation, the preset range monitoring method is rather one-sided. Because the corresponding software has different operating conditions and operating environments, the accuracy of the original preset range needs to be adjusted. It does not confirm the relevant characteristic traffic based on different historical traffic data generated by the corresponding software in the past, which makes it impossible to improve the comprehensiveness of the software's security monitoring. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an Internet-based software runtime environment security monitoring system. This system solves the problem that the lack of identification of characteristic traffic based on different historical traffic data generated by the corresponding software in the historical process makes it impossible to improve the comprehensiveness of software security monitoring.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an Internet-based software runtime environment security monitoring system, comprising:

[0007] The historical data acquisition end acquires historical traffic data generated by the specified software during its operation and transmits the acquired historical traffic data to the feature interval confirmation end.

[0008] The feature interval confirmation end identifies the historical traffic data associated with each running phase from the historical traffic data generated by the specified software. Then, based on the current time, it selects the relevant running phases that are close to the current time from different running phases, performs interval analysis on the historical traffic data of the selected relevant running phases, and selects the feature traffic interval and feature trend interval belonging to this specified software.

[0009] The real-time data monitoring terminal monitors the real-time traffic of the specified software during its operation and transmits the monitored real-time traffic to the anomaly assessment center.

[0010] The anomaly assessment center determines the operational security status of the specified software based on real-time traffic monitored by the software, as well as the identified characteristic traffic and trend intervals. Based on the assessment results, it determines whether the specified software exhibits an abnormal state and transmits the abnormal traffic data associated with the duration of the abnormal state to the similarity analysis and processing center. Specifically:

[0011] The real-time traffic monitored by the specified software is denoted as S. t Where t represents different times, and the monitored real-time traffic S t Check against the determined characteristic flow range, if S t If the characteristic flow range is ∈, then continuous monitoring will be carried out. The characteristic flow range identifies the flow change data between the current time and the previous time and labels it as B. t If B t If ∈ the characteristic trend interval, then continue monitoring; if The characteristic trend interval records the abnormal state of the specified software during operation, marks the current time as the abnormal time, records the specific time period associated with the real-time confirmed and consecutively occurring abnormal times as the duration of this abnormal state, records the traffic data generated by the specified software during the duration as abnormal traffic data, and transmits the determined abnormal traffic data to the similarity analysis and processing center.

[0012] The cloud database stores traffic characteristic curves belonging to different attack characteristics, and all of these traffic characteristic curves are preset curves.

[0013] The similarity analysis and processing center, based on the abnormal traffic data over a continuous period confirmed by the anomaly assessment center, first identifies the data change curve associated with this abnormal traffic data, then extracts the stored traffic characteristic curve from the cloud database, and performs similarity analysis between the data change curve and the traffic characteristic curve to assess whether the currently generated abnormal traffic data is attack data. The specific method is as follows:

[0014] Based on the abnormal traffic data confirmed during the continuous period, confirm the data change curve associated with the corresponding continuous period;

[0015] Based on the confirmed sets of flow characteristic curves, a similarity analysis is performed on individual flow characteristic curves and data change curves selected sequentially from these sets. The data change curves and individual flow characteristic curves are placed in the same two-dimensional coordinate system, and the data change curves are horizontally shifted. The shift process with the longest intersection segment between the data change curve and the individual flow characteristic curve is identified and denoted as the standard process. The percentage of the intersection segment located on the data change curve within the standard process is then identified and denoted as ZB. p Where p represents different flow characteristic curves, identifying ZB p Does it satisfy: ZB p If the abnormal traffic rate is ≥90%, it will be directly identified as attack data and displayed. If it is not met, other traffic characteristic curves will be selected and their intersection segments analyzed with this data change curve to confirm the existence of ZB (Zero-Block). p In ≥90% of cases, if such abnormal traffic data exists, it will be identified as attack data; otherwise, a personnel intervention signal will be generated.

[0016] Furthermore, the specific method by which the feature interval confirmation terminal performs interval analysis on the historical traffic data of the selected relevant operating phase is as follows:

[0017] Based on the current time, select N groups of operation phases that are close to the current time, where N is a preset value. Process the traffic data of each group of operation phases, confirm the different traffic data associated with different times within the corresponding operation phase, and then generate the traffic data change curve belonging to the corresponding operation phase.

[0018] From all the traffic data associated with each operational phase, select the maximum and minimum traffic data values ​​to confirm a traffic range;

[0019] Based on this traffic range, the characteristic traffic range of the specified software is confirmed. The confirmation method is as follows:

[0020] S11. Take the current flow range as the processing range, confirm the flow difference of the processing range, this flow difference = the maximum value of the flow range - the minimum value of the flow range, and then confirm the relevant line segments belonging to this flow range from each set of flow data change curves, and record the bus length L of the relevant line segments. Use: flow difference ÷ L = M to confirm the feature density M associated with the current processing range.

[0021] Prioritize the downgrade process:

[0022] S111. Lower the maximum value of the flow range by a set of unit flow rates to confirm another set of processing ranges. The unit flow rate is the preset flow rate. Using the same method as step S11, confirm the feature density M associated with the corresponding processing range. k , where k represents different processing intervals;

[0023] S112. Reduce the maximum value of the flow range by two sets of unit flow rates. Reconfirm a processing range and the characteristic density of the corresponding processing range. Then, reduce the unit flow rate in sequence and confirm the characteristic density of different processing ranges in sequence. Continue until the flow rate difference between the maximum and minimum values ​​of the last processing range equals one set of unit flow rates, thus completing the reduction process.

[0024] Then execute the upward adjustment process:

[0025] S121. Increase the minimum value of the flow range by one unit flow to confirm another set of processing ranges. Using the same method as step S11, confirm the feature density M associated with the corresponding processing range. k ;

[0026] S122. Increase the minimum value of the flow range by two sets of unit flow rates. Reconfirm a processing range and confirm the characteristic density of the corresponding processing range. Then, increase the unit flow rate in sequence and confirm the characteristic density of different processing ranges in sequence until the flow rate difference between the maximum and minimum values ​​of the last processing range equals a set of unit flow rates. This completes the downward adjustment process.

[0027] Based on the different feature densities M associated with different processing intervals k From several sets of feature densities M k In the middle, select M k The processing interval associated with min is used as the characteristic traffic interval of the currently specified software.

[0028] Based on the characteristic traffic range identified by the specified software, the characteristic trend range associated with the current specified software is identified, specifically as follows:

[0029] From the confirmed flow data change curves, the curve segments belonging to this characteristic flow range are removed, and the remaining curve segments are identified and recorded as segments to be processed.

[0030] The traffic data difference associated with each unit of time in the processing segment is confirmed, and the traffic data difference is ≥0. From the confirmed traffic data difference, the minimum and maximum values ​​are selected as the characteristic trend interval associated with the current specified software.

[0031] This invention provides an internet-based software runtime environment security monitoring system. Compared with existing technologies, it has the following advantages:

[0032] This invention performs interval analysis on historical traffic data, calculates the feature density of different processing intervals, and compares them to determine the interval with the most obvious features as the feature traffic interval. This method fully considers the distribution and variation of traffic data. Furthermore, based on the feature traffic interval, it further determines the feature trend interval, which can comprehensively characterize the traffic characteristics during normal software operation, laying the foundation for accurate subsequent judgment of abnormal states.

[0033] The system combines real-time traffic with characteristic traffic ranges and characteristic trend ranges for judgment. When real-time traffic exceeds the characteristic traffic range, it further determines whether an anomaly is due based on whether the traffic change data is within the characteristic trend range. This dual judgment standard effectively avoids misjudgments that may be caused by a single standard and improves the accuracy of anomaly detection. For example, some short-term traffic fluctuations may still be within a normal trend and will not be misjudged as anomalies.

[0034] Based on pre-defined traffic characteristic curves derived from past attack patterns, the similarity analysis and processing center performs similarity analysis on the change curves of abnormal traffic data. This attack identification method, based on historical experience, can quickly locate known types of attacks, improving the efficiency and targeting of attack detection. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the principle framework of the present invention. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Please see Figure 1This application provides an Internet-based software operating environment security monitoring system, including a historical data acquisition terminal, a feature interval confirmation terminal, a real-time data monitoring terminal, an anomaly assessment center, a cloud database, and a similarity analysis and processing center. The historical data acquisition terminal is electrically connected to the input node of the feature interval confirmation terminal, and both the feature interval confirmation terminal and the real-time data monitoring terminal are electrically connected to the input node of the anomaly assessment center. The anomaly assessment center and the cloud database are both electrically connected to the input node of the similarity analysis and processing center.

[0038] Among them, the historical data acquisition end acquires the historical traffic data generated by the specified software during operation and transmits the acquired historical traffic data to the feature interval confirmation end. The historical traffic data is the different traffic data generated by the corresponding software at different times during operation. That is, the corresponding software will generate interactive traffic during normal operation, and thus generate the corresponding traffic data.

[0039] Among them, the characteristic interval confirmation end identifies the historical traffic data associated with each running phase from the historical traffic data generated by the specified software. Then, based on the current time, it selects the relevant running phases that are close to the current time from different running phases, performs interval analysis on the historical traffic data of the selected relevant running phases, and selects the characteristic traffic interval and characteristic trend interval belonging to this specified software. Specifically, during the normal operation of each software, except for the startup phase where the traffic is large, the traffic data generated during the normal operation phase should be relatively balanced and regular. Therefore, based on this type of traffic data, a specific analysis of the numerical curve can be performed to confirm the specific traffic characteristics, which is convenient for identifying abnormal traffic phases during subsequent numerical monitoring.

[0040] The specific method for performing interval analysis on historical traffic data for selected relevant operational phases is as follows:

[0041] Based on the current time, select N sets of operation phases that are close to the current time, where N is a preset value set by the operator in advance, generally 5, and should not be too many. Process the flow data of each set of operation phases, confirm the different flow data associated with different times within the corresponding operation phase, and then generate the flow data change curve belonging to the corresponding operation phase (the horizontal axis of this curve is the time line, and the vertical axis is the flow data).

[0042] From all the traffic data associated with each operational phase (the traffic data here refers to the traffic data associated with all operational phases), select the maximum and minimum traffic data values ​​to confirm a set of traffic ranges;

[0043] Based on this traffic range, the characteristic traffic range of the specified software is confirmed:

[0044] S11. Take the current flow range as the processing range, confirm the flow difference of the processing range, this flow difference = the maximum value of the flow range - the minimum value of the flow range, and then confirm the relevant line segments belonging to this flow range from each set of flow data change curves, and record the bus length L of the relevant line segments. Use: flow difference ÷ L = M to confirm the feature density M associated with the current processing range.

[0045] Prioritize the downgrade process:

[0046] S111. Lower the maximum value of the flow range by one unit flow rate to confirm another set of processing ranges. The unit flow rate is a preset flow rate, which is set in advance by the operator, generally 100kb. Using the same method as step S11, confirm the feature density M associated with the corresponding processing range. k , where k represents different processing intervals;

[0047] S112. Reduce the maximum value of the flow range by two sets of unit flow rates. Reconfirm a processing range and the characteristic density of the corresponding processing range. Then, reduce the unit flow rate in sequence and confirm the characteristic density of different processing ranges in sequence. Continue until the flow rate difference between the maximum and minimum values ​​of the last processing range equals one set of unit flow rates, thus completing the reduction process.

[0048] Then execute the upward adjustment process:

[0049] S121. Increase the minimum value of the flow range by one unit flow to confirm another set of processing ranges. Using the same method as step S11, confirm the feature density M associated with the corresponding processing range. k , ;

[0050] S122. Increase the minimum value of the flow range by two sets of unit flow rates. Reconfirm a processing range and confirm the characteristic density of the corresponding processing range. Then, increase the unit flow rate in sequence and confirm the characteristic density of different processing ranges in sequence until the flow rate difference between the maximum and minimum values ​​of the last processing range equals a set of unit flow rates. This completes the downward adjustment process.

[0051] Based on the different feature densities M associated with different processing intervals k From several sets of feature densities M k In the middle, select M k The processing interval associated with min(the relevant stage with the smallest difference and the longest line length L, then the traffic associated with this stage has the most obvious characteristics) is taken as the characteristic traffic interval of the current specified software.

[0052] Based on the characteristic traffic range identified by the specified software, the characteristic trend range associated with the current specified software is identified:

[0053] From the confirmed flow data change curves, the curve segments belonging to this characteristic flow range are removed, and the remaining curve segments are identified and recorded as segments to be processed.

[0054] The traffic data difference associated with the segment to be processed within a unit time (i.e., adjacent moments, which can be directly known in the coordinate system of the traffic data change curve) is confirmed, and the traffic data difference is ≥0. The unit time is a preset time, generally 1 second. From the confirmed several sets of traffic data differences, the minimum and maximum values ​​are selected as the characteristic trend interval associated with the current specified software.

[0055] Specifically, during software operation, there are generally two phases: a stable phase and a fluctuating phase. The stable phase is first identified based on the specific changes in traffic data, which corresponds to the characteristic traffic range associated with the specified software. Once the characteristic traffic range is determined, the associated fluctuating phase can be identified based on the identified stable phase. The fluctuating phase is the phase excluding the stable phase. Based on the corresponding fluctuating phase, identifying the changes in data per unit time allows for the confirmation of the trend range. This enables the identification of the relevant characteristics of the specified software one by one, facilitating subsequent specific judgment of abnormal situations and real-time monitoring of the security status of the specified software's operating environment, ensuring comprehensive network security monitoring.

[0056] Among them, the real-time data monitoring terminal monitors the real-time traffic of the specified software during operation and transmits the monitored real-time traffic to the anomaly assessment center. The monitored real-time traffic is monitored by the system's built-in traffic monitoring module.

[0057] The anomaly assessment center, based on the real-time traffic monitored by the specified software and the confirmed characteristic traffic and trend intervals, determines the operational security status of the specified software, assesses whether the specified software is in an abnormal state based on the determination results, and transmits the abnormal traffic data associated with the duration of the abnormal state to the similarity analysis and processing center. The specific method for determining the operational security status of the specified software is as follows:

[0058] The real-time traffic monitored by the specified software is denoted as S. t Where t represents different times, and the monitored real-time traffic S t Check against the determined characteristic flow range, if S t If the characteristic flow range is ∈, then continuous monitoring will be carried out. The characteristic flow range identifies the flow change data between the current time and the previous time and labels it as B. t If B tIf ∈ the characteristic trend interval, then continue monitoring; if The characteristic trend interval records the abnormal state of the specified software during operation, marks the current time as the abnormal time, records the specific time period associated with the real-time confirmed and consecutively occurring abnormal times as the duration of this abnormal state, records the traffic data generated by the specified software during the duration as abnormal traffic data, and transmits the determined abnormal traffic data to the similarity analysis and processing center.

[0059] Specifically, when the monitored real-time traffic changes normally, the generated traffic data will change within the confirmed characteristic traffic range. When it changes outside the corresponding characteristic traffic range, trend confirmation can be performed. If the confirmed value change trend does not belong to the confirmed trend range, it means that the corresponding software operation status is abnormal. Then, the abnormal traffic data associated with the abnormal operation status can be confirmed, and such abnormal traffic data can be verified and analyzed.

[0060] Among them, the cloud database stores traffic characteristic curves belonging to different attack characteristics. These traffic characteristic curves are all preset curves, which are preset in advance by relevant operators based on past attack characteristics. When each different attack characteristic is generated, there will be corresponding characteristic traffic changes, thereby locking the corresponding traffic characteristic curve.

[0061] The similarity analysis and processing center, based on the abnormal traffic data concerning a continuous period confirmed by the anomaly assessment center, first identifies the data change curve associated with this abnormal traffic data, then extracts the stored traffic characteristic curve from the cloud database, performs similarity analysis between the data change curve and the traffic characteristic curve, and assesses whether the currently generated abnormal traffic data is attack data. The specific assessment method is as follows:

[0062] Based on the abnormal traffic data confirmed during the continuous period, confirm the data change curve associated with the corresponding continuous period (the horizontal axis is the time line, and the vertical axis is the abnormal traffic).

[0063] Based on the confirmed sets of flow characteristic curves, a similarity analysis is performed on individual flow characteristic curves and data change curves selected sequentially from these sets. The data change curves and individual flow characteristic curves are placed in the same two-dimensional coordinate system, and the data change curves are controlled to move horizontally. During this movement, the set with the longest intersection segment between the data change curve and the individual flow characteristic curve is identified (the intersection segment is the line segment where the data change curve and the individual flow characteristic curve overlap). This movement process is denoted as the standard process, and the percentage of the data change curve containing the intersection segment in the standard process is identified and denoted as ZB. pWhere p represents different flow characteristic curves, identifying ZB p Does it satisfy: ZB p If the percentage is ≥90%, this abnormal traffic data will be directly labeled as attack data and displayed. If it is not met, other traffic characteristic curves will be selected and their intersection segments analyzed with this data change curve to confirm the presence of ZB (Zero-Block). p In ≥90% of cases, if such abnormal traffic data exists, it will be identified as attack data. If it does not exist, a personnel intervention signal will be generated. After personnel intervention, the current running process will be assessed to determine whether it is normal. If it is normal, the characteristic traffic range and characteristic trend range associated with the current specified software will be redefined. If it is not normal, such traffic data will be deleted to ensure the security of the environment in which the current software is running.

[0064] Specifically, by storing pre-defined traffic characteristic curves based on past attack patterns in a cloud database, the system can quickly match known attack types. When abnormal traffic occurs, it can be directly compared with these pre-defined curves, significantly improving detection efficiency and accuracy compared to non-targeted detection methods. For example, if a specific DDoS attack has previously exhibited a unique pattern of traffic rise and fall, storing this as a traffic characteristic curve allows the system to quickly identify similar attacks. Once abnormal traffic appears, the system can confirm the data change curve based on the abnormal traffic data and quickly perform a similarity analysis with the traffic characteristic curves in the cloud database. This rapid matching mechanism helps to identify the attack type in its early stages, buying time for timely countermeasures.

[0065] Some of the data in the above formulas are numerical calculations with dimensions removed, and the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0066] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A software runtime environment security monitoring system based on the Internet, characterized in that, include: The historical data acquisition end acquires historical traffic data generated by the specified software during its operation and transmits the acquired historical traffic data to the feature interval confirmation end. The feature interval confirmation end identifies the historical traffic data associated with each running phase from the historical traffic data generated by the specified software. Then, based on the current time, it selects relevant running phases close to the current time from different running phases, performs interval analysis on the historical traffic data of the selected relevant running phases, and selects the feature traffic interval and feature trend interval belonging to this specified software. The specific method is as follows: Based on the current time, select N groups of operation phases that are close to the current time, where N is a preset value. Process the traffic data of each group of operation phases, confirm the different traffic data associated with different times within the corresponding operation phase, and then generate the traffic data change curve belonging to the corresponding operation phase. From all the traffic data associated with each operational phase, select the maximum and minimum traffic data values ​​to confirm a traffic range; Based on this traffic range, the characteristic traffic range of the specified software is confirmed: S11, the current traffic range is taken as the processing range, the traffic difference of the processing range is confirmed, this traffic difference = the maximum value of the traffic range - the minimum value of the traffic range, and then the relevant line segments belonging to this traffic range are confirmed from each group of traffic data change curves, and the bus length L of the relevant line segments is recorded. The characteristic density M associated with the current processing range is confirmed by using: traffic difference ÷ L = M. Prioritize the downgrade process: S111. Lower the maximum value of the flow range by a set of unit flow rates to confirm another set of processing ranges. The unit flow rate is the preset flow rate. Using the same method as step S11, confirm the feature density M associated with the corresponding processing range. k , where k represents different processing intervals; S112. Reduce the maximum value of the flow range by two sets of unit flow rates. Reconfirm a processing range and the characteristic density of the corresponding processing range. Then, reduce the unit flow rate in sequence and confirm the characteristic density of different processing ranges in sequence until the flow rate difference between the maximum and minimum values ​​of the last processing range equals one set of unit flow rates. This completes the reduction process. Then execute the upward adjustment process: S121. Increase the minimum value of the flow range by one unit flow to confirm another set of processing ranges. Using the same method as step S11, confirm the feature density M associated with the corresponding processing range. k ; S122. Increase the minimum value of the flow range by two sets of unit flow rates. Reconfirm a processing range and confirm the characteristic density of the corresponding processing range. Then, increase the unit flow rate in sequence and confirm the characteristic density of different processing ranges in sequence until the flow rate difference between the maximum and minimum values ​​of the last processing range equals a set of unit flow rates. This completes the downward adjustment process. Based on the different feature densities M associated with different processing intervals k From several sets of feature densities M k In the middle, select M k The processing interval associated with min is used as the characteristic traffic interval of the currently specified software. Based on the characteristic traffic range confirmed by the specified software, the characteristic trend range associated with the current specified software is confirmed; The real-time data monitoring terminal monitors the real-time traffic of the specified software during its operation and transmits the monitored real-time traffic to the anomaly assessment center. The anomaly assessment center determines the operational security status of the specified software based on the real-time traffic monitored by the specified software and the confirmed characteristic traffic range and characteristic trend range. Based on the determination results, it assesses whether the specified software has an abnormal state and transmits the abnormal traffic data associated with the duration of the abnormal state to the similarity analysis and processing center. The cloud database stores traffic characteristic curves belonging to different attack characteristics, and all of these traffic characteristic curves are preset curves. The similarity analysis and processing center, based on the abnormal traffic data for a continuous period of time confirmed by the anomaly assessment center, first identifies the data change curve associated with this abnormal traffic data, then extracts the stored traffic characteristic curve from the cloud database, performs similarity analysis between the data change curve and the traffic characteristic curve, and assesses whether the currently generated abnormal traffic data is attack data.

2. The Internet-based software runtime environment security monitoring system according to claim 1, characterized in that, The specific method by which the feature interval confirmation terminal confirms the feature trend interval associated with the specified software is as follows: From the confirmed flow data change curves, the curve segments belonging to this characteristic flow range are removed, and the remaining curve segments are identified and recorded as segments to be processed. The traffic data difference associated with each unit of time in the processing segment is confirmed, and the traffic data difference is ≥0. From the confirmed traffic data difference, the minimum and maximum values ​​are selected as the characteristic trend interval associated with the current specified software.

3. The Internet-based software runtime environment security monitoring system according to claim 1, characterized in that, The anomaly assessment center determines the specific security status of designated software operation in the following way: The real-time traffic monitored by the specified software is denoted as S. t Where t represents different times, and the monitored real-time traffic S t Check against the determined characteristic flow range, if S t If S ∈ the characteristic flow range, then continuous monitoring will be carried out. t If a characteristic flow range is identified, the flow change data between the current time and the previous time is confirmed and labeled as B. t If B t If B ∈ the characteristic trend interval, then continue monitoring; if B t If the characteristic trend interval is defined, it records that the specified software has an abnormal state during operation, marks the current time as the abnormal time, records the specific time period associated with the abnormal times that are confirmed in real time and appear in succession as the duration of this abnormal state, records the traffic data generated by the specified software during the duration as abnormal traffic data, and transmits the determined abnormal traffic data to the similarity analysis and processing center.

4. The Internet-based software runtime environment security monitoring system according to claim 3, characterized in that, The similarity analysis and processing center determines whether the currently generated abnormal traffic data is attack data in the following specific way: Based on the abnormal traffic data confirmed during the continuous period, confirm the data change curve associated with the corresponding continuous period; Based on the confirmed sets of flow characteristic curves, a similarity analysis is performed on individual flow characteristic curves and data change curves selected sequentially from these sets. The data change curves and individual flow characteristic curves are placed in the same two-dimensional coordinate system, and the data change curves are horizontally shifted. The shift process with the longest intersection segment between the data change curve and the individual flow characteristic curve is identified and denoted as the standard process. The percentage of the intersection segment located on the data change curve within the standard process is then identified and denoted as ZB. p Where p represents different flow characteristic curves, identifying ZB p Does it satisfy: ZB p If the percentage is ≥90%, this abnormal traffic data will be directly identified as attack data and displayed.

5. The Internet-based software runtime environment security monitoring system according to claim 4, characterized in that, ZB p If ZB is not satisfied p When the percentage is ≥90%, other flow characteristic curves are selected and their intersection segments are analyzed with this data change curve to confirm the presence of ZB. p In ≥90% of cases, if such abnormal traffic data exists, it will be identified as attack data; otherwise, a personnel intervention signal will be generated.

Images