A network anomaly monitoring system and method based on data analysis

Abstract

The application discloses a network anomaly monitoring system and method based on data analysis, and belongs to the technical field of network anomaly monitoring.The application comprises the following steps: obtaining access records of a monitoring object, screening all access records of the monitoring object to obtain a first screening set; screening the first screening set to obtain a second screening set; analyzing reference traffic characteristics and reference behavior characteristics of the monitoring object according to the second screening set; analyzing abnormal traffic characteristics and behavior abnormal characteristics of the monitoring object, and dividing the abnormal levels of the monitoring object; judging the real-time abnormal level of the monitoring object according to real-time access records of the monitoring object, and executing different protection schemes; the application effectively reduces the false alarm and missed alarm rates, improves the accuracy of network security protection, accurately identifies potential threats, shortens the response time, solves the limitations of traditional rule matching methods, and improves the ability of the network to adapt to complex attack modes.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network anomaly monitoring, and particularly relates to a network anomaly monitoring system and method based on data analysis. BACKGROUND

[0002] Internet has greatly changed people's work and life style, changed people's concept, greatly promoted the development of society, at the same time, as a virtual world, Internet also exists behaviors of damaging others' interests as the real society, such as DDoS attack, malicious software intrusion and other malicious behaviors, which seriously affect the availability of network services on the Internet.

[0003] Internet has greatly changed people's work and life style, changed people's concept, greatly promoted the development of society, at the same time, as a virtual world, Internet also exists behaviors of damaging others' interests as the real society, such as DDoS attack, malicious software intrusion and other malicious behaviors, which seriously affect the availability of network services on the Internet.

[0004] At present, the monitoring system sets the upper limit of the flow threshold and other network anomaly prevention measures through flow threshold detection technology and source and destination host credibility verification technology, but in the case of attack mode change, such as normal user attack, the traditional monitoring method is easy to be bypassed, and it is difficult to identify threats and take protective measures in time, resulting in low accuracy of anomaly detection, false positives and false negatives, and reducing the practicability and security of network services.

[0005] Therefore, there is an urgent need for a network anomaly monitoring system based on data analysis to solve the above problems. SUMMARY

[0006] The purpose of the present application is to provide a network anomaly monitoring system based on data analysis to solve the problems raised in the background.

[0007] In order to solve the above technical problems, the present application provides the following technical scheme:

[0008] A network anomaly monitoring method based on data analysis, the method comprising the following steps:

[0009] S1, obtaining the access record of the monitoring object from the database, the access record comprising flow record and behavior record; according to the flow record, screening all access records of the monitoring object to obtain a first screening set;

[0010] S2, screening the first screening set according to the behavior record to obtain a second screening set; analyzing the baseline flow characteristics of the monitoring object according to the flow record in the second screening set; analyzing the baseline behavior characteristics of the monitoring object according to the behavior record in the second screening set;

[0011] S3, according to the reference traffic characteristics of the monitoring object, analyzing the abnormal traffic characteristics of the monitoring object; according to the reference behavior characteristics of the monitoring object, analyzing the behavior abnormal characteristics of the monitoring object; according to the abnormal traffic characteristics and the behavior abnormal characteristics, dividing the abnormal level of the monitoring object;

[0012] S4, according to the real-time access record of the monitoring object, judging the real-time abnormal level of the monitoring object, and according to the real-time abnormal level of the monitoring object, executing different protection schemes.

[0013] According to the above technical scheme, the step S1 comprises:

[0014] S1-1, the monitoring object accesses each pair of servers once, generates an access record and stores it in the database; the traffic record comprises source IP and traffic packet data value; the behavior record comprises access path and stay interval;

[0015] The traffic packet data value refers to the size of the data packet sent or received by the monitoring object when accessing the server; the access path refers to the specific URL path requested by the monitoring object when accessing the server; the stay interval refers to the length of time the monitoring object stays after accessing a page or resource;

[0016] S1-2, extracting all access records of the monitoring object from the database, according to the source IP in the traffic record, counting the number of occurrences of each source IP in all traffic records, obtaining the source IP with the most occurrences as the reference IP of the monitoring object; filtering all access records of the monitoring object according to the reference IP, filtering out the access records with the source IP as the reference IP in the access records, forming a record set; calculating the average value and standard deviation of the traffic packet data value corresponding to each traffic record in the record set according to the record set, setting the first parameter; calculating the value of the standard deviation multiplied by the first parameter, and calculating the value added to the average value, as the first filtering value;

[0017] S1-3, filtering the record set according to the first filtering value, filtering out the access records with the traffic packet data value less than or equal to the first filtering value in the traffic record, obtaining a first filtering set;

[0018] Extracting the access records of the monitoring object from the database and preliminarily filtering through the traffic data to remove irrelevant data and improve the accuracy of subsequent analysis; determining the main IP of the monitoring object by counting the number of occurrences of the source IP to improve the reliability of the filtered data; filtering out the access records meeting the requirements by analyzing the traffic statistics to reduce the interference of abnormal data.

[0019] According to the above technical scheme, the step S2 comprises:

[0020] S2-1, extracting the access path of each behavior record from the first screening set, counting the access path with the most occurrences as the reference path of the monitoring object; screening the first screening set according to the reference path, screening out the access records with the reference path, and obtaining the second screening set;

[0021] S2-2, calculating the average value of the traffic packet data value corresponding to each traffic record in the second screening set as the reference data value of the monitoring object; extracting the maximum value of the traffic packet data value corresponding to each traffic record, calculating the ratio of the maximum value of the traffic packet data value to the reference data value as the data maximum of the monitoring object; taking the reference IP, the reference data value and the data maximum as the reference traffic characteristics of the monitoring object;

[0022] S2-3, according to the behavior record in the second screening set, combining the dwell interval in the behavior record, calculating the average value of the dwell interval in each behavior record as the reference interval of the monitoring object; extracting the maximum value of the dwell interval corresponding to each behavior record, calculating the ratio of the maximum value of the dwell interval to the reference interval as the interval maximum of the monitoring object; taking the reference path, the reference interval and the interval maximum as the reference behavior characteristics of the monitoring object;

[0023] Further screening the access records and calculating the reference traffic characteristics and the reference behavior characteristics of the monitoring object to provide a reference for the normal access mode; through access path analysis, screening out the path with the highest access frequency to determine the reference path of the normal access behavior; by calculating the mean and maximum values of the traffic packet data, determining the reference value of the normal access traffic to provide a basis for abnormal traffic judgment; by calculating the mean and maximum values of the dwell interval, determining the normal dwell time of the user behavior to provide a standard for abnormal behavior judgment.

[0024] According to the above technical scheme, the step S3 comprises:

[0025] S3-1, according to the reference traffic characteristics of the monitoring object, calculating the ratio of the data maximum to the reference data value as the data parameter; obtaining the traffic packet data value in a certain access record, calculating the ratio of the traffic packet data value in the access record to the reference data value as the data abnormal characteristics of the monitoring object;

[0026] If the source IP in the access record of the monitoring object is different from the reference IP, it is taken as the IP abnormal characteristics of the monitoring object; the data parameter, the data abnormal characteristics and the IP abnormal characteristics are taken as the abnormal traffic characteristics of the monitoring object;

[0027] S3-2, according to the reference behavior characteristics of the monitoring object, the ratio of the maximum interval to the reference interval is calculated as an interval parameter; the dwell interval in a certain access record is obtained, and the ratio of the dwell interval in the access record to the reference interval is calculated as an interval abnormality characteristic of the monitoring object;

[0028] If the access path in the access record of the monitoring object is different from the reference path, the path abnormality characteristic of the monitoring object is obtained; the interval parameter, the interval abnormality characteristic and the path abnormality characteristic are taken as the behavior abnormality characteristic of the monitoring object;

[0029] S3-3, according to the abnormal flow characteristic and the behavior abnormality characteristic, the data weight and the interval weight are set, the value obtained by multiplying the data weight and the data parameter is taken as the data threshold (also referred to as data judgment score); the value obtained by multiplying the interval weight and the interval parameter is taken as the interval threshold (also referred to as interval judgment score); the value obtained by adding the data judgment score and the interval judgment score is taken as the abnormal threshold;

[0030] The value obtained by multiplying the data weight and the data abnormality characteristic is taken as the data abnormality score; the value obtained by multiplying the interval weight and the interval abnormality characteristic is taken as the interval abnormality score; the value obtained by adding the data abnormality score and the interval abnormality score is taken as the comprehensive abnormality score;

[0031] If the comprehensive abnormality score corresponding to a certain access record of the monitoring object is less than or equal to the abnormal threshold, and there is no IP abnormality characteristic and path abnormality characteristic, the abnormal level of the monitoring object is the first level;

[0032] If the comprehensive abnormality score corresponding to a certain access record of the monitoring object is less than or equal to the abnormal threshold, and there is an IP abnormality characteristic or a path abnormality characteristic, the abnormal level of the monitoring object is the second level;

[0033] If the comprehensive abnormality score corresponding to a certain access record of the monitoring object is greater than the abnormal threshold, the abnormal level of the monitoring object is the third level;

[0034] The access record is analyzed, and the risk level of the monitoring object is divided according to the abnormal degree; the flow characteristic is calculated to determine whether the access flow is abnormal; the behavior characteristic is calculated to identify the abnormality of the access behavior; the abnormal level is set through the calculation of the data weight and the behavior weight, the comprehensiveness of the abnormal detection is ensured, the detection accuracy is improved, and the false positive and false negative rates are reduced.

[0035] According to the above technical scheme, the step S4 comprises:

[0036] According to the real-time access record of the monitoring object, the IP abnormality characteristic, the path abnormality characteristic and the comprehensive abnormality score corresponding to the access record are obtained, and the real-time abnormal level of the monitoring object is determined;

[0037] If the real-time abnormality level of the monitoring object is the first level, no operation is performed;

[0038] If the real-time abnormality level of the monitoring object is the second level, identity verification is performed on the monitoring object; if the identity verification is passed, the access of the monitoring object is not prohibited; if the identity verification is not passed, the access of the monitoring object is prohibited, and an abnormality alarm is issued;

[0039] If the real-time abnormality level of the monitoring object is the third level, the access of the monitoring object is prohibited, and an abnormality alarm is issued;

[0040] According to the abnormality level of the monitoring object, different protection strategies are executed to ensure network security; the first level allows normal access without affecting user experience; the second level requires identity verification to improve security and avoid misblocking normal users; the third level directly blocks and alarms to prevent potential attacks from causing damage; through hierarchical response, the flexibility and effectiveness of network security protection are improved.

[0041] A network abnormality monitoring system based on data analysis, comprising a data acquisition module, a data analysis module, an abnormality detection module, and a protection response module;

[0042] The data acquisition module is configured to acquire and store traffic data and behavior data of the monitoring object, including source IP, traffic packet data value, access path, and stay interval; the data analysis module is configured to calculate baseline traffic characteristics and baseline behavior characteristics of the monitoring object, including baseline IP, baseline data value, baseline path, and baseline interval; the abnormality detection module is configured to analyze abnormal traffic characteristics and behavior abnormality characteristics of the monitoring object, and analyze the abnormality level of the monitoring object to determine whether IP abnormality or path abnormality exists; and the protection response module is configured to perform identity verification, access restriction, or abnormality alarm according to the real-time abnormality level of the monitoring object to ensure that the network security protection strategy is effective.

[0043] According to the above technical solution, the data acquisition module comprises a traffic recording unit and a behavior recording unit;

[0044] The traffic recording unit is configured to acquire and store traffic data of the monitoring object, including source IP and traffic packet data value, to provide basic data for traffic analysis; and the behavior recording unit is configured to acquire and store access behavior data of the monitoring object, including access path and stay interval information, to provide support for behavior analysis.

[0045] According to the above technical solution, the data analysis module comprises a traffic analysis unit and a behavior analysis unit;

[0046] The flow analysis unit is used for counting and calculating the baseline flow characteristics of the monitoring object, including the baseline IP, baseline data value and data maximum, to determine the abnormal flow characteristics; the behavior analysis unit is used for calculating the baseline behavior characteristics of the monitoring object, including the baseline path, baseline interval and interval maximum, to determine the behavior abnormal characteristics.

[0047] According to the above technical solution, the anomaly detection module includes a flow detection unit and a behavior detection unit;

[0048] The flow detection unit is used for calculating the data abnormal characteristics and IP abnormal characteristics according to the ratio of the data maximum to the baseline data value, in combination with the real-time access flow data, to determine whether there is abnormal flow; the behavior detection unit is used for calculating the interval abnormal characteristics and path abnormal characteristics according to the ratio of the interval maximum to the baseline interval, in combination with the real-time access behavior data, to determine whether there is behavior abnormality.

[0049] According to the above technical solution, the protection response module includes a level determination unit and a strategy execution unit;

[0050] The level determination unit is used for calculating the comprehensive abnormal score according to the abnormal flow characteristics and behavior abnormal characteristics, and dividing the abnormal level to determine the corresponding processing strategy; the strategy execution unit is used for executing different protection schemes according to the real-time abnormal level to ensure network security.

[0051] Compared with the prior art, the present application has the following beneficial effects:

[0052] The present application realizes intelligent identification of network anomalies by accurately modeling network flow characteristics and user behavior patterns, and dynamically adjusting the anomaly detection threshold combined with real-time monitoring data, improves the accuracy and robustness of the monitoring system; at the same time, the present application establishes standardized flow characteristics and behavior characteristics by historical access data, optimizes the anomaly detection process, effectively reduces the false positive and false negative rates, and improves the accuracy of network security protection; secondly, the present application accurately identifies potential threats by combining flow characteristic screening, behavior characteristic matching and abnormal level division, shortens the response time, reduces the limitations of traditional rule matching methods, and improves the ability of the system to adapt to complex attack patterns; in addition, the present application automatically executes identity verification, access restriction or alarm response according to the abnormal level combined with dynamic protection strategies, ensures the real-time and effectiveness of network security protection, and improves the stability and practicality of the network security monitoring system. BRIEF DESCRIPTION OF DRAWINGS

[0053] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation of the present application. In the drawings:

[0054] Figure 1 is a flow diagram of a network anomaly monitoring method based on data analysis according to the present application;

[0055] Figure 2 is a structural diagram of a network anomaly monitoring system based on data analysis according to the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0057] Please refer to Figure 1 The present application provides technical solutions:

[0058] A network anomaly monitoring method based on data analysis, the method comprising the following steps:

[0059] S1, obtaining access records of a monitoring object from a database, the access records comprising traffic records and behavior records; filtering all access records of the monitoring object according to the traffic records to obtain a first filtered set;

[0060] According to the above technical solution, the step S1 comprises:

[0061] S1-1, the monitoring object performs an access to each pair of servers to generate an access record and store it in the database; the traffic records comprise source IP and traffic packet data value; the behavior records comprise access path and stay interval;

[0062] The traffic packet data value refers to the size of the data packet sent or received by the monitoring object when accessing the server; the access path refers to the specific URL path requested by the monitoring object when accessing the server; the stay interval refers to the length of time the monitoring object stays after accessing a certain page or resource;

[0063] S1-2, extracting all access records of the monitoring object from the database, counting the number of occurrences of each source IP in all traffic records according to the source IP in the traffic records, obtaining the source IP with the most occurrences as the reference IP of the monitoring object; filtering all access records of the monitoring object according to the reference IP to filter out the access records with the reference IP as the source IP in the access records to form a first record set; calculating the average value and the standard deviation of the traffic packet data value corresponding to each traffic record in the first record set according to the first record set, setting a first parameter; calculating the value obtained by multiplying the standard deviation by the first parameter, and calculating the value obtained by adding the value to the average value as a first filtering value;

[0064] S1-3, screening the access records in the flow record set according to the first screening value, and obtaining a first screening set;

[0065] The access records of the monitoring object are extracted from the database, and preliminary screening is performed through flow data to remove irrelevant data and improve the accuracy of subsequent analysis; the main IP of the monitoring object is determined by counting the number of occurrences of the source IP, thereby improving the reliability of the screened data; and the access records meeting the requirements are screened out through flow statistical analysis, thereby reducing the interference of abnormal data;

[0066] In specific implementation, from the access records of the monitoring object, first, the records with the highest flow value and access frequency are found out as the basic data set through flow record screening. This is because the centralized data of flow and behavior records can accurately reflect the normal access mode and trend, and through these screening results, abnormal data can be effectively excluded, thereby ensuring the accuracy and reliability of subsequent analysis

[0067] S2, screening the first screening set according to the behavior record to obtain a second screening set; analyzing the baseline flow characteristics of the monitoring object according to the flow record in the second screening set; and analyzing the baseline behavior characteristics of the monitoring object according to the behavior record in the second screening set;

[0068] According to the above technical solution, the step S2 comprises:

[0069] S2-1, extracting the access path of each behavior record from the first screening set, counting the access path with the most occurrences as the baseline path of the monitoring object; and screening the access records with the baseline path from the first screening set to obtain the second screening set;

[0070] S2-2, calculating the average value of the flow packet data value corresponding to each flow record in the second screening set as the baseline data value of the monitoring object; extracting the maximum value of the flow packet data value corresponding to each flow record, calculating the ratio of the maximum value of the flow packet data value to the baseline data value as the data maximum of the monitoring object; and taking the baseline IP, the baseline data value and the data maximum as the baseline flow characteristics of the monitoring object;

[0071] S2-3, calculating the average value of the stay interval in each behavior record in the second screening set as the baseline interval of the monitoring object in combination with the stay interval in the behavior record; extracting the maximum value of the stay interval corresponding to each behavior record, calculating the ratio of the maximum value of the stay interval to the baseline interval as the interval maximum of the monitoring object; and taking the baseline path, the baseline interval and the interval maximum as the baseline behavior characteristics of the monitoring object.

[0072] Further filter the access records, and calculate the reference flow characteristics and reference behavior characteristics of the monitoring object to provide a reference of normal access mode; through access path analysis, filter the path with the highest access frequency to determine the reference path of normal access behavior; through calculating the mean and maximum of the flow packet data, determine the reference value of normal access flow to provide a basis for abnormal flow judgment; through calculating the mean and maximum of the stay interval, determine the normal stay time of user behavior to provide a standard for abnormal behavior judgment;

[0073] On the basis of the target data set, further filter the most representative access path and stay interval behavior characteristics as reference characteristics. This is because selecting the most common access path and stay time can reflect the access habits of normal users, providing a clear and comparable reference for subsequent anomaly detection, thereby improving the ability to identify potential abnormal behavior.

[0074] S3、According to the reference flow characteristics of the monitoring object, analyze the abnormal flow characteristics of the monitoring object; according to the reference behavior characteristics of the monitoring object, analyze the behavior abnormal characteristics of the monitoring object; according to the abnormal flow characteristics and behavior abnormal characteristics, divide the abnormal level of the monitoring object;

[0075] According to the above technical solution, the step S3 includes:

[0076] S3-1, according to the reference flow characteristics of the monitoring object, calculate the ratio of the maximum data amount to the reference data value as a data parameter; obtain the flow packet data value in a certain access record, and calculate the ratio of the flow packet data value in the access record to the reference data value as the data abnormal characteristics of the monitoring object;

[0077] If the source IP in the access record of the monitoring object is different from the reference IP, it is regarded as the IP abnormal characteristics of the monitoring object; the data parameter, data abnormal characteristics and IP abnormal characteristics are regarded as the abnormal flow characteristics of the monitoring object;

[0078] S3-2, according to the reference behavior characteristics of the monitoring object, calculate the ratio of the maximum interval to the reference interval as an interval parameter; obtain the stay interval in a certain access record, and calculate the ratio of the stay interval in the access record to the reference interval as the interval abnormal characteristics of the monitoring object;

[0079] If the access path in the access record of the monitoring object is different from the reference path, it is regarded as the path abnormal characteristics of the monitoring object; the interval parameter, interval abnormal characteristics and path abnormal characteristics are regarded as the behavior abnormal characteristics of the monitoring object;

[0080] S3-3, according to the abnormal traffic feature and the behavior abnormal feature, setting data weight and interval weight, calculating the value of data weight multiplied by data parameter as data judgment score; calculating the value of interval weight multiplied by interval parameter as interval judgment score; calculating the value of data judgment score and interval judgment score as abnormal threshold value;

[0081] calculating the value of data weight multiplied by data abnormal feature as data abnormal score; calculating the value of interval weight multiplied by interval abnormal feature as interval abnormal score; calculating the value of data abnormal score and interval abnormal score as comprehensive abnormal score;

[0082] If the comprehensive abnormal score corresponding to the access record of the monitoring object is less than or equal to the abnormal threshold value, and there is no IP abnormal feature and path abnormal feature, the abnormal level of the monitoring object is the first level;

[0083] If the comprehensive abnormal score corresponding to the access record of the monitoring object is less than or equal to the abnormal threshold value, and there is IP abnormal feature or path abnormal feature, the abnormal level of the monitoring object is the second level;

[0084] If the comprehensive abnormal score corresponding to the access record of the monitoring object is greater than the abnormal threshold value, the abnormal level of the monitoring object is the third level;

[0085] The access record is analyzed, and the risk level of the monitoring object is divided according to the abnormal degree; the traffic feature is calculated to determine whether the access traffic is abnormal; the behavior feature is calculated to identify the abnormal situation of the access behavior; the abnormal level is set through the calculation of data weight and behavior weight, to ensure the comprehensiveness of abnormal detection, improve the detection accuracy, and reduce the false positive and false negative rates.

[0086] S4, according to the real-time access record of the monitoring object, judging the real-time abnormal level of the monitoring object, and executing different protection schemes according to the real-time abnormal level of the monitoring object;

[0087] According to the above technical scheme, the step S4 comprises:

[0088] According to the real-time access record of the monitoring object, the IP abnormal feature, the path abnormal feature and the comprehensive abnormal score corresponding to the access record are obtained, and the real-time abnormal level of the monitoring object is judged;

[0089] If the real-time abnormal level of the monitoring object is the first level, no operation is performed;

[0090] If the real-time abnormal level of the monitoring object is the second level, identity authentication is performed on the monitoring object; if the identity authentication is passed, the access of the monitoring object is not prohibited; if the identity authentication is not passed, the access of the monitoring object is prohibited, and an abnormal alarm is issued;

[0091] If the real-time anomaly level of the monitoring object is the third level, access of the monitoring object is prohibited, and an anomaly alarm is issued;

[0092] According to the anomaly level of the monitoring object, different protection strategies are executed to ensure network security; the first level allows normal access without affecting user experience; the second level requires identity verification to improve security and avoid misblocking normal users; the third level directly blocks and alarms to prevent potential attacks from causing damage; through hierarchical response, the flexibility and effectiveness of network security protection are improved.

[0093] Please refer to Figure 2 A network anomaly monitoring system based on data analysis, comprising a data acquisition module, a data analysis module, an anomaly detection module, and a protection response module;

[0094] The data acquisition module is configured to acquire and store traffic data and behavior data of the monitoring object, including source IP, traffic packet data value, access path, and stay interval; the data analysis module is configured to calculate baseline traffic characteristics and baseline behavior characteristics of the monitoring object, including baseline IP, baseline data value, baseline path, and baseline interval; the anomaly detection module is configured to analyze abnormal traffic characteristics and behavior abnormal characteristics of the monitoring object, and analyze the anomaly level of the monitoring object to determine whether there is IP anomaly or path anomaly; the protection response module is configured to perform identity verification, access restriction, or anomaly alarm according to the real-time anomaly level of the monitoring object to ensure the effectiveness of the network security protection strategy.

[0095] According to the above technical solution, the data acquisition module comprises a traffic recording unit and a behavior recording unit;

[0096] The traffic recording unit is configured to acquire and store traffic data of the monitoring object, including source IP and traffic packet data value, to provide basic data for traffic analysis; the behavior recording unit is configured to acquire and store access behavior data of the monitoring object, including access path and stay interval, to provide support for behavior analysis.

[0097] According to the above technical solution, the data analysis module comprises a traffic analysis unit and a behavior analysis unit;

[0098] The traffic analysis unit is configured to calculate baseline traffic characteristics of the monitoring object, including baseline IP, baseline data value, and maximum data amount, to determine abnormal traffic characteristics; the behavior analysis unit is configured to calculate baseline behavior characteristics of the monitoring object, including baseline path, baseline interval, and maximum interval amount, to determine behavior abnormal characteristics.

[0099] According to the above technical solution, the anomaly detection module comprises a traffic detection unit and a behavior detection unit;

[0100] The flow detection unit is used for calculating data abnormality features and IP abnormality features according to a ratio of the maximum data amount to the reference data value, in combination with real-time access flow data, to determine whether abnormal flow exists; and the behavior detection unit is used for calculating interval abnormality features and path abnormality features according to a ratio of the maximum interval to the reference interval, in combination with real-time access behavior data, to determine whether behavior abnormality exists.

[0101] According to the above technical solution, the protection response module comprises a level determination unit and a strategy execution unit.

[0102] The level determination unit is used for calculating a comprehensive abnormality score according to the abnormal flow features and the behavior abnormality features, and dividing an abnormality level to determine a corresponding processing strategy; and the strategy execution unit is used for executing different protection schemes according to real-time abnormality levels to ensure network security.

[0103] It should be noted that, in this document, the terms such as first and second are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between such entities or operations. Also, the terms "comprises", "comprising", or any other variations thereof are intended to cover non-exclusive inclusions, so that a process, method, article, or apparatus including a list of elements does not only include those elements, but also includes other elements not expressly listed, or inherent to such process, method, article, or apparatus.

[0104] Finally, it should be noted that: the above only describes the preferred embodiments of the present application, and does not limit the present application, although the present application has been described in detail with reference to the foregoing embodiments, for those skilled in the art, the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced equivalently. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A network anomaly monitoring method based on data analysis, characterized in that: The method comprises the following steps: S1, obtaining access records of a monitoring object from a database, wherein the access records comprise traffic records and behavior records; filtering all access records of the monitoring object according to the traffic records to obtain a first filtered set; S2, filtering the first filtered set according to the behavior records to obtain a second filtered set; analyzing baseline traffic characteristics of the monitoring object according to the traffic records in the second filtered set; analyzing baseline behavior characteristics of the monitoring object according to the behavior records in the second filtered set; S3, analyzing abnormal traffic characteristics of the monitoring object according to the baseline traffic characteristics of the monitoring object; analyzing behavior abnormal characteristics of the monitoring object according to the baseline behavior characteristics of the monitoring object; dividing an abnormal level of the monitoring object according to the abnormal traffic characteristics and the behavior abnormal characteristics; S4, judging a real-time abnormal level of the monitoring object according to real-time access records of the monitoring object, and executing different protection schemes according to the real-time abnormal level of the monitoring object; The step S3 comprises: S3-1, calculating a ratio of a maximum data amount to a baseline data value as a data parameter according to the baseline traffic characteristics of the monitoring object; obtaining a traffic packet data value in a certain access record, and calculating a ratio of the traffic packet data value in the access record to the baseline data value as a data abnormal characteristic of the monitoring object; If a source IP in the access records of the monitoring object is different from a baseline IP, the source IP is taken as an IP abnormal characteristic of the monitoring object; the data parameter, the data abnormal characteristic and the IP abnormal characteristic are taken as abnormal traffic characteristics of the monitoring object; S3-2, calculating a ratio of a maximum interval amount to a baseline interval as an interval parameter according to the baseline behavior characteristics of the monitoring object; obtaining a stay interval in a certain access record, and calculating a ratio of the stay interval in the access record to the baseline interval as an interval abnormal characteristic of the monitoring object; If an access path in the access records of the monitoring object is different from a baseline path, the access path is taken as a path abnormal characteristic of the monitoring object; the interval parameter, the interval abnormal characteristic and the path abnormal characteristic are taken as behavior abnormal characteristics of the monitoring object; S3-3, setting a data weight and an interval weight according to the abnormal traffic characteristics and the behavior abnormal characteristics; calculating a value obtained by multiplying the data weight and the data parameter as a data judgment score; calculating a value obtained by multiplying the interval weight and the interval parameter as an interval judgment score; and calculating a value obtained by adding the data judgment score and the interval judgment score as an abnormal threshold value; calculating a value obtained by multiplying the data weight and the data abnormal characteristic as a data abnormal score; calculating a value obtained by multiplying the interval weight and the interval abnormal characteristic as an interval abnormal score; and calculating a value obtained by adding the data abnormal score and the interval abnormal score as a comprehensive abnormal score; If the comprehensive abnormal score corresponding to a certain access record of the monitoring object is less than or equal to the abnormal threshold value, and there is no IP abnormal characteristic and path abnormal characteristic, the abnormal level of the monitoring object is the first level; If the comprehensive abnormal score corresponding to a certain access record of the monitoring object is less than or equal to the abnormal threshold value, and there is an IP abnormal characteristic or a path abnormal characteristic, the abnormal level of the monitoring object is the second level; If the comprehensive anomaly score corresponding to the access record of the monitoring object is greater than the anomaly threshold, the anomaly level of the monitoring object is the third level.

2. The network anomaly monitoring method based on data analysis according to claim 1, characterized in that: The step S1 comprises: S1-1, the monitoring object performs an access to each pair of servers, generates an access record and stores it in the database; the traffic record comprises a source IP and a traffic packet data value; the behavior record comprises an access path and a stay interval; S1-2, all access records of the monitoring object are extracted from the database, the occurrence times of each source IP in all traffic records are counted according to the source IP in the traffic record, the source IP with the most occurrence times is obtained as the reference IP of the monitoring object; all access records of the monitoring object are filtered according to the reference IP, the access records with the source IP being the reference IP in the access record are filtered out to form a first record set; the average value and the standard deviation of the traffic packet data value corresponding to each traffic record in the first record set are calculated, and the first parameter is set; the value obtained by multiplying the standard deviation by the first parameter is calculated, and the value obtained by adding the value to the average value is taken as the first filtering value; S1-3, the first record set is filtered according to the first filtering value, the access records with the traffic packet data value in the traffic record being less than or equal to the first filtering value are filtered out, and a first filtering set is obtained.

3. The network anomaly monitoring method based on data analysis according to claim 2, characterized in that: The step S2 comprises: S2-1, the access path of each behavior record is extracted from the first filtering set, the access path with the most occurrence times is counted as the reference path of the monitoring object; the first filtering set is filtered according to the reference path, the access records with the access path being the reference path are filtered out, and a second filtering set is obtained; S2-2, the average value of the traffic packet data value corresponding to each traffic record in the second filtering set is calculated as the reference data value of the monitoring object; the maximum value of the traffic packet data value corresponding to each traffic record is extracted, the ratio of the maximum value of the traffic packet data value to the reference data value is calculated as the data maximum amount of the monitoring object; the reference IP, the reference data value and the data maximum amount are taken as the reference traffic characteristics of the monitoring object; S2-3, the average value of the stay interval in each behavior record is calculated as the reference interval of the monitoring object according to the behavior record in the second filtering set and the stay interval in the behavior record; the maximum value of the stay interval corresponding to each behavior record is extracted, the ratio of the maximum value of the stay interval to the reference interval is calculated as the interval maximum amount of the monitoring object; the reference path, the reference interval and the interval maximum amount are taken as the reference behavior characteristics of the monitoring object.

4. The network anomaly monitoring method based on data analysis of claim 1, wherein: The step S4 comprises: According to the real-time access record of the monitoring object, the IP anomaly characteristics, the path anomaly characteristics and the comprehensive anomaly score corresponding to the access record are obtained, and the real-time anomaly level of the monitoring object is judged; If the real-time anomaly level of the monitoring object is the first level, no operation is performed; If the real-time anomaly level of the monitoring object is the second level, identity authentication is performed on the monitoring object; if the identity authentication is passed, the access of the monitoring object is not prohibited; if the identity authentication is not passed, the access of the monitoring object is prohibited, and an anomaly alarm is issued; If the real-time abnormal level of the monitoring object is the third level, the access of the monitoring object is prohibited, and an abnormal alarm is issued.

5. A network anomaly monitoring system based on data analysis, for implementing the network anomaly monitoring method based on data analysis in any one of claims 1-4, characterized in that: The system comprises a data collection module, a data analysis module, an abnormality detection module and a protection response module. The data collection module is configured to acquire and store traffic data and behavior data of the monitoring object, including source IP, traffic packet data value, access path and interval. The data analysis module is configured to calculate baseline traffic characteristics and baseline behavior characteristics of the monitoring object, including baseline IP, baseline data value, baseline path and baseline interval. The abnormality detection module is configured to analyze abnormal traffic characteristics and behavior abnormal characteristics of the monitoring object, and analyze the abnormal level of the monitoring object, and determine whether there is IP abnormality or path abnormality.

6. The network anomaly monitoring system based on data analysis of claim 5, wherein: The protection response module is configured to perform identity verification, access restriction or abnormal alarm according to the real-time abnormal level of the monitoring object, and ensure the effectiveness of the network security protection strategy. The data collection module comprises a traffic recording unit and a behavior recording unit.

7. The network anomaly monitoring system based on data analysis of claim 5, wherein: The traffic recording unit is configured to acquire and store traffic data of the monitoring object, including source IP and traffic packet data value, and provide basic data for traffic analysis. The behavior recording unit is configured to acquire and store access behavior data of the monitoring object, including access path and interval information, and provide support for behavior analysis. The data analysis module comprises a traffic analysis unit and a behavior analysis unit.

8. The network anomaly monitoring system based on data analysis of claim 5, wherein: The traffic analysis unit is configured to calculate baseline traffic characteristics of the monitoring object, including baseline IP, baseline data value and maximum data amount, to determine abnormal traffic characteristics. The behavior analysis unit is configured to calculate baseline behavior characteristics of the monitoring object, including baseline path, baseline interval and maximum interval amount, to determine behavior abnormal characteristics.

9. The network anomaly monitoring system based on data analysis of claim 5, wherein: The abnormality detection module comprises a traffic detection unit and a behavior detection unit. The traffic detection unit is configured to calculate data abnormal characteristics and IP abnormal characteristics according to the ratio of the maximum data amount to the baseline data value, in combination with real-time access traffic data, to determine whether there is abnormal traffic. The behavior detection unit is configured to calculate interval abnormal characteristics and path abnormal characteristics according to the ratio of the maximum interval amount to the baseline interval, in combination with real-time access behavior data, to determine whether there is behavior abnormality. The protection response module comprises a level determination unit and a strategy execution unit. The level determination unit is configured to calculate comprehensive abnormal scores according to abnormal traffic characteristics and behavior abnormal characteristics, and divide the abnormal level to determine corresponding processing strategies. The strategy execution unit is configured to execute different protection schemes according to the real-time abnormal level, to ensure network security.

Images