Network security monitoring method and device

Abstract

The invention provides a network security monitoring method and device, and relates to the technical field of network security monitoring, and the method comprises the following steps: 1, a flow collection module which is used for collecting real-time network flow, and is installed on two side plates, a front plate and a rear plate, the bottom plate is driven to be switched between the closed state and the folded state, when the bottom plate is in the switched state, the top plate can conduct state switching synchronously through the connecting part, and when the bottom plate and the top plate are in the closed state, the bottom plate and the top plate can seal the bottom ends and the top ends of the side plates correspondingly. At the moment, a closed cavity can be formed among the two side plates, the top plate, the front plate, the rear plate and the bottom plate, dust or rats, ants and the like can be effectively prevented from entering the cavity when the device does not work, and modules in the cavity are protected; and the bottom plate and the top plate cannot seal and shield the bottom end and the top end of the side plate, so that the heat dissipation efficiency of the module is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a network security monitoring method and device. Background Art

[0002] Network security monitoring is the core link to ensure the security of an enterprise or organization's network environment. Its core goal is to detect and respond to potential threats in a timely manner by real-time monitoring, analyzing network traffic, device status, and user behavior. Network security monitoring needs to combine the actual needs of the enterprise, select a platform with high scalability and intelligent analysis capabilities, and continuously optimize the detection rules and response processes. It is recommended to give priority to deploying a SIEM system that supports multi-source data correlation analysis, and at the same time combine EDR (Endpoint Detection and Response) to achieve end-to-network collaborative protection.

[0003] In network security monitoring, most modules are connected to the data center or the egress network device through serial ports / RJ45 and installed in the chassis. Currently, most existing chassis are closed boxes. During long-term operation, it is extremely easy for modules to overheat. The ventilation and heat dissipation methods mostly use the ventilation openings on the chassis and the built-in cooling fans in the chassis for heat dissipation. However, through this heat dissipation method, the heat dissipation efficiency is reduced, and heat is easily accumulated in the chassis, causing irreversible damage to the modules and affecting the service life of each module. Summary of the Invention

[0004] The purpose of the present invention is to provide a network security monitoring method and device, aiming to solve the problem that in the prior art, the ventilation and heat dissipation methods mostly use the ventilation openings on the chassis and the built-in cooling fans in the chassis for heat dissipation. However, through this heat dissipation method, the heat dissipation efficiency is reduced, and heat is easily accumulated in the chassis, causing irreversible damage to the modules and affecting the service life of each module.

[0005] To achieve the above purpose, the present invention adopts the following technical solutions: A network security monitoring method includes the following steps:

[0006] Step 1: Flow collection module: used to collect real-time network traffic;

[0007] Step 2: Data preprocessing module: receives the original packet data transmitted by the flow collection module, performs protocol identification, feature extraction, noise reduction, or preliminary filtering to reduce the subsequent analysis burden;

[0008] Step 3: Large model analysis module: integrates an artificial intelligence pre-trained large model to deeply analyze and detect anomalies in the preprocessed data;

[0009] Step 4: Threat Detection and Response Module: Based on the detection results output by the large model and combined with predefined rules or policies, the engine determines the threat level and triggers response actions, linking with external firewalls, intrusion detection systems or intrusion prevention systems, and security management platforms to achieve security handling such as automatic blocking, isolation, and alarming;

[0010] Step 5: Visualization Management Module: Provides a Web management interface or a local LCD / Console interface to display real-time monitoring status, alarm overview, traffic trend charts, and statistical analysis charts;

[0011] Step 6: Log Audit and Model Maintenance Module: Responsible for complete log recording of the monitoring process and alarm information, storing it locally or in a cluster, and can be externally connected to storage, regularly collecting data and feeding it back to the artificial intelligence large model for training or fine-tuning to provide a basis for subsequent optimization; and supports auditing and tracing of system operation logs and policy changes.

[0012] A network security monitoring device further includes a mounting plate and two side plates mounted on the mounting plate. The mounting plate is provided with a front plate and a rear plate, and the front plate and the rear plate are respectively fixedly connected to the left and right ends of the two side plates. The modules can be installed on the two side plates, the front plate, and the rear plate. The mounting plate is provided with a bottom plate located below the side plates, and the side plates are provided with a top plate mounted at the top of the side plates. The two side plates, the top plate, the front plate, the rear plate, and the bottom plate form a rectangular array, and a closed cavity can be formed between the two side plates, the top plate, the front plate, the rear plate, and the bottom plate, and the modules are installed in the cavity. Both the bottom plate and the top plate have two states: closed and folded.

[0013] A further technical solution of the present invention is that the bottom plate includes a first fixing block fixedly connected to the bottom end of the side plate. First baffles are hinged on both the left and right sides of the first fixing block. When the upper surfaces of the two first baffles are respectively in contact with the bottom ends of the front plate and the rear plate, it is in the closed state. At this time, the first fixing block and the first baffles form a linear array. On the contrary, when the angle between the first fixing block and the first baffles is less than 180 degrees, the two first baffles cannot be in contact with the front plate and the rear plate, and at this time it is in the folded state.

[0014] A further technical solution of the present invention is that the top plate includes a second fixing block provided at the top end of the side plate. Second baffles are hinged at both the left and right ends of the second fixing block. When the upper surfaces of the two second baffles are respectively in contact with the top ends of the front plate and the rear plate, it is in the closed state. At this time, the second fixing block and the second baffles form a linear array. On the contrary, when the angle between the second fixing block and the second baffles is less than 180 degrees, the two second baffles cannot be in contact with the front plate and the rear plate, and at this time it is in the folded state.

[0015] A further technical solution of the present invention is that a driving part is arranged inside the mounting plate for driving the bottom plate to switch between a closed state and a folded state.

[0016] A further technical solution of the present invention is that the driving part includes a chute opened inside the mounting plate. Two sliders are slidably connected in the chute, and the two sliders are respectively hinged to the ends of the two first baffles away from each other. A bidirectional lead screw is threadedly connected in the two sliders.

[0017] A further technical solution of the present invention is that a connecting part is arranged on the mounting plate, which can both install and fix the second fixing block and can also synchronously switch between a closed state and a folded state when the bottom plate switches states.

[0018] A further technical solution of the present invention is that the connecting part includes a pull rod fixedly connected to the mounting plate. The top end of the pull rod penetrates through the first fixing block and is fixedly connected to the bottom surface of the second fixing block. Limiting grooves are opened on one side surface of the two side plates close to the pull rod. Limiting blocks are slidably connected in the limiting grooves, and the limiting blocks are fixedly connected to the second fixing block. Two limiting rods are fixedly connected between the two side plates, and the two limiting rods are respectively located below the second baffle and are in contact with the bottom surface of the second baffle.

[0019] A further technical solution of the present invention is that a heat dissipation fan is installed inside the first fixing block, and the air flow direction of the heat dissipation fan is parallel to the height direction of the front plate and the rear plate.

[0020] The beneficial effects of the present invention are as follows:

[0021] The module is installed on the two side plates, the front plate and the rear plate, and can drive the bottom plate to switch between a closed state and a folded state. When the bottom plate switches states, the top plate can synchronously switch states. When the bottom plate and the top plate are in the closed state, the bottom plate and the top plate can respectively close the bottom end and the top end of the side plates. At this time, a closed cavity can be formed among the two side plates, the top plate, the front plate, the rear plate and the bottom plate, which can effectively prevent dust, mice, ants, etc. from entering the inside of the cavity when not working, and protect the module inside the cavity. When the bottom plate and the top plate are in the folded state, the bottom plate and the top plate cannot close and block the bottom end and the top end of the side plates, and the top end and the bottom end of the side plates will be in a through state, thereby improving the air flow inside the cavity and the heat dissipation efficiency of the module. Description of the Drawings

[0022] Figure 1 It is a side view three-dimensional view in a specific embodiment of the present invention.

[0023] Figure 2 It is a partial structure three-dimensional sectional view in the side view direction in a specific embodiment of the present invention.

[0024] Figure 3 It is a partial structure plan sectional view in the side view direction in a specific embodiment of the present invention.

[0025] In the figure: 1, mounting plate; 2, bottom plate; 21, first fixing block; 22, first baffle; 3, side plate; 4, top plate; 41, second fixing block; 42, second baffle; 5, front plate; 6, rear plate; 71, chute; 72, slider; 73, bidirectional lead screw; 81, pull rod; 82, limiting groove; 83, limiting block; 84, limiting rod. Specific embodiments

[0026] The following further describes the specific embodiments of the present invention with reference to the accompanying drawings.

[0027] A network security monitoring method and device, comprising the following steps:

[0028] Step 1: Flow collection module: used to collect real-time network traffic, and utilize a dedicated packet capture card or high-performance NIC at the hardware level to ensure the throughput of high-concurrency data;

[0029] Step 2: Data preprocessing module: receives the original packet data transmitted by the flow collection module, performs protocol identification, feature extraction, denoising or preliminary filtering to reduce the subsequent analysis burden;

[0030] Step 3: Large model analysis module: integrates an artificial intelligence pre-trained large model, deeply analyzes and performs anomaly detection on the preprocessed data, relies on high-performance CPUs / GPUs or AI acceleration units for deep learning inference, and can identify hidden threats, zero-day vulnerability exploitation, APT attacks, etc.;

[0031] Step 4: Threat determination and response module: according to the detection results output by the large model, combined with predefined rules or policies, the engine judges the threat level and triggers response actions, and links with external firewalls, intrusion detection systems or intrusion prevention systems, and security management platforms to achieve security dispositions such as automatic blocking, isolation, and warning;

[0032] Step 5: Visualization management module: provides a Web management interface or a local LCD / Console interface to display the real-time monitoring status, alarm overview, traffic trend chart, and statistical analysis chart. Administrators can configure policies, view historical events, and export reports through this interface;

[0033] Step 6: Log auditing and model maintenance module: responsible for complete log recording of the monitoring process and alarm information, stored locally or in a cluster, and can be externally connected to storage, regularly collect data, and feedback to the artificial intelligence large model for training or fine-tuning to provide a basis for subsequent optimization; and supports auditing and tracing of system operation logs and policy changes

[0034] Such as Figures 1-3As shown in the figure, it further includes a mounting plate 1 and two side plates 3 mounted on the mounting plate 1. A front plate 5 and a rear plate 6 are arranged on the mounting plate 1, and the front plate 5 and the rear plate 6 are respectively fixedly connected to the left and right ends of the two side plates 3. The module can be installed on the two side plates 3, the front plate 5 and the rear plate 6. A bottom plate 2 is arranged on the mounting plate 1, and the bottom plate 2 is located below the side plates 3. A top plate 4 is arranged on the side plates 3, and the top plate 4 is installed at the top of the side plates 3. The two side plates 3, the top plate 4, the front plate 5, the rear plate 6 and the bottom plate 2 are in a rectangular array. A closed cavity can be formed between the two side plates 3, the top plate 4, the front plate 5, the rear plate 6 and the bottom plate 2, and the module is installed in the cavity. Both the bottom plate 2 and the top plate 4 have two states: closed and folded. In the closed state, the bottom plate 2 and the top plate 4 can respectively close the bottom end and the top end of the side plates 3, reducing the air flow inside the side plates 3, and effectively preventing dust, mice, ants, etc. from entering the inside of the cavity when not working, so as to protect the module inside the cavity. In the folded state, the bottom plate 2 and the top plate 4 cannot close and block the bottom end and the top end of the side plates 3, and the top end and the bottom end of the side plates 3 will be in a through state, thereby improving the air flow inside the cavity and the heat dissipation efficiency of the module.

[0035] As Figures 1-3 shown in the figure, the bottom plate 2 includes a first fixing block 21 fixedly connected to the bottom end of the side plate 3. A first baffle 22 is hinged on both the left and right sides of the first fixing block 21. When the upper surfaces of the two first baffles 22 are respectively in contact with the bottom ends of the front plate 5 and the rear plate 6, it is in the closed state. At this time, the first fixing block 21 and the first baffle 22 are in a linear array, thereby effectively preventing dust, mice, ants, etc. from entering the inside of the cavity through the bottom end of the side plate 3 when not working. On the contrary, when the included angle between the first fixing block 21 and the first baffle 22 is less than 180 degrees, the two first baffles 22 cannot be in contact with the front plate 5 and the rear plate 6, and at this time it is in the folded state, thereby improving the ventilation inside the cavity.

[0036] As Figures 1-3 shown in the figure, the top plate 4 includes a second fixing block 41 arranged at the top of the side plate 3. A second baffle 42 is hinged at both the left and right ends of the second fixing block 41. When the upper surfaces of the two second baffles 42 are respectively in contact with the top ends of the front plate 5 and the rear plate 6, it is in the closed state. At this time, the second fixing block 41 and the second baffle 42 are in a linear array, thereby effectively preventing dust, mice, ants, etc. from entering the inside of the cavity through the top of the side plate 3 when not working. On the contrary, when the included angle between the second fixing block 41 and the second baffle 42 is less than 180 degrees, the two second baffles 42 cannot be in contact with the front plate 5 and the rear plate 6, and at this time it is in the folded state, thereby improving the ventilation inside the cavity.

[0037] As Figure 3As shown, a driving part is arranged inside the mounting plate 1, which is used to drive the bottom plate 2 to switch between two states of being closed and folded, so that the working state of the bottom plate 2 can be conveniently adjusted;

[0038] The driving part includes a sliding groove 71 formed in the mounting plate 1. Two sliders 72 are slidably connected in the sliding groove 71, and the two sliders 72 are respectively hinged to the remote ends of the two first baffles 22. A bidirectional lead screw 73 is threadedly connected in the two sliders 72. By connecting the bidirectional lead screw 73 to an external driving source, the bidirectional lead screw 73 rotates. The rotation of the bidirectional lead screw 73 can drive the two sliders 72 to approach each other, and then the movement of the sliders 72 can drive the first fixing block 21 to rise through the first baffle 22, so that the bottom plate 2 can be conveniently driven to switch between the closed and folded states.

[0039] As Figure 2 shown, a connecting part is arranged on the mounting plate 1, which can not only install and fix the second fixing block 41, but also switch synchronously between the closed and folded states when the bottom plate 2 changes its state;

[0040] The connecting part includes a pull rod 81 fixedly connected to the mounting plate 1. The top end of the pull rod 81 penetrates through the first fixing block 21 and is fixedly connected to the bottom surface of the second fixing block 41. Limiting grooves 82 are formed in the side surfaces of the two side plates 3 close to the pull rod 81. Limiting blocks 83 are slidably connected in the limiting grooves 82, and the limiting blocks 83 are fixedly connected to the second fixing block 41. Two limiting rods 84 are fixedly connected between the two side plates 3, and the two limiting rods 84 are respectively located below the second baffle 42 and are in contact with the bottom surface of the second baffle 42. When the first fixing block 21 rises, it can drive the side plates 3 to rise, and then the rising of the side plates 3 can drive the limiting rods 84 to rise. Then the rising of the limiting rods 84 can push the second baffle 42 to rotate around the second fixing block 41, so that the top plate 4 can be conveniently driven to switch between the closed and folded states.

[0041] As Figure 2 shown, a heat dissipation fan is installed in the first fixing block 21. After the heat dissipation fan is started, the direction of the wind of the heat dissipation fan is parallel to the height direction of the front plate 5 and the rear plate 6. When the bottom plate 2 and the top plate 4 are in the folded state, the wind blown by the heat dissipation fan can form a through wind and pass through the cavity, so that the ventilation in the cavity can be greatly improved and the heat dissipation efficiency of the module can be improved.

[0042] Working principle: Install the module on two side plates 3, the front plate 5 and the rear plate 6, and then start the driving part. The driving part can drive the bottom plate 2 to switch between the closed state and the folded state. When the bottom plate 2 is switching states, the top plate 4 can synchronously switch states through the connecting part. When the bottom plate 2 and the top plate 4 are in the closed state, the bottom plate 2 and the top plate 4 can respectively close the bottom end and the top end of the side plate 3. At this time, a closed cavity can be formed among the two side plates 3, the top plate 4, the front plate 5, the rear plate 6 and the bottom plate 2, which can effectively prevent dust, mice, ants, etc. from entering the inside of the cavity when not working, and protect the module in the cavity. When the bottom plate 2 and the top plate 4 are in the folded state, the bottom plate 2 and the top plate 4 cannot close and block the bottom end and the top end of the side plate 3, and the top end and the bottom end of the side plate 3 will be in a through state, so as to improve the air flow in the cavity and the heat dissipation efficiency of the module.

[0043] For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and without departing from the spirit or basic characteristics of the present invention, the present invention can be implemented in other specific forms. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present invention. Any reference signs in the claims should not be regarded as limiting the claimed claim.

[0044] In addition, it should be understood that although this specification is described according to embodiments, not every embodiment only contains an independent technical solution. This narrative way of the specification is only for clarity. Those skilled in the art should regard the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A network security monitoring method, characterized in that It includes the following steps: Step 1: Traffic collection module: used to collect real-time network traffic; Step 2: Data preprocessing module: receives the original packet data transmitted by the traffic collection module, performs protocol identification, feature extraction, denoising or preliminary filtering to reduce the subsequent analysis burden; Step 3: Large model analysis module: integrates an artificial intelligence pre-trained large model to deeply analyze and detect anomalies in the preprocessed data; Step 4: Threat determination and response module: according to the detection results output by the large model, combined with predefined rules or policies, the engine judges the threat level and triggers response actions, and links with external firewalls, intrusion detection systems or intrusion prevention systems, and security management platforms to achieve security dispositions such as automatic blocking, isolation, and alarming; Step 5: Visualization management module: provides a Web management interface or a local LCD / Console interface to display real-time monitoring status, alarm overview, traffic trend chart, and statistical analysis chart; Step 6: Log auditing and model maintenance module: responsible for complete log recording of the monitoring process and alarm information, stored locally or in a cluster, and can be externally connected to storage, regularly collect data, and feedback it to the artificial intelligence large model for training or fine-tuning to provide a basis for subsequent optimization; And it supports auditing and tracing of system operation logs and policy changes.

2. A network security monitoring device, characterized in that, It also includes an installation plate (1) and two side plates (3) installed on the installation plate (1). A front plate (5) and a rear plate (6) are provided on the installation plate (1), and the front plate (5) and the rear plate (6) are respectively fixedly connected to the left and right ends of the two side plates (3). The module can be installed on the two side plates (3), the front plate (5) and the rear plate (6). A bottom plate (2) is provided on the installation plate (1), and the bottom plate (2) is located below the side plates (3). A top plate (4) is provided on the side plates (3), and the top plate (4) is installed at the top of the side plates (3). The two side plates (3), the top plate (4), the front plate (5), the rear plate (6) and the bottom plate (2) are in a rectangular array, and a closed cavity can be formed between the two side plates (3), the top plate (4), the front plate (5), the rear plate (6) and the bottom plate (2), and the module is installed in the cavity. Both the bottom plate (2) and the top plate (4) have two states: closed and folded.

3. The network security monitoring device according to claim 2, characterized in that, The bottom plate (2) includes a first fixing block (21) fixedly connected to the bottom end of the side plate (3). A first baffle (22) is hinged to both the left and right sides of the first fixing block (21). When the upper surfaces of the two first baffles (22) are respectively in contact with the bottom ends of the front plate (5) and the rear plate (6), it is in the closed state. At this time, the first fixing block (21) and the first baffle (22) are in a linear array. On the contrary, when the angle between the first fixing block (21) and the first baffle (22) is less than 180 degrees, the two first baffles (22) cannot be in contact with the front plate (5) and the rear plate (6), and at this time it is in the folded state.

4. The network security monitoring device according to claim 2, characterized in that, The top plate (4) includes a second fixing block (41) provided at the top end of the side plate (3). The left and right ends of the second fixing block (41) are each hinged with a second baffle (42). When the upper surfaces of the two second baffles (42) are respectively in contact with the top ends of the front plate (5) and the rear plate (6), it is in a closed state. At this time, the second fixing block (41) and the second baffles (42) are arranged in a linear array. On the contrary, when the included angle between the second fixing block (41) and the second baffles (42) is less than 180 degrees, the two second baffles (42) cannot be in contact with the front plate (5) and the rear plate (6), and at this time it is in a folded state.

5. The network security monitoring device according to claim 2, characterized in that, A driving part is arranged in the mounting plate (1) for driving the bottom plate (2) to switch between the closed and folded states.

6. The network security monitoring device according to claim 5, characterized in that, The driving part includes a chute (71) opened in the mounting plate (1). Two sliders (72) are slidably connected in the chute (71), and the two sliders (72) are respectively hinged to the mutually remote ends of the two first baffles (22). A bidirectional lead screw (73) is threadedly connected in the two sliders (72).

7. A network security monitoring device according to claim 4, characterized in that, A connecting part is arranged on the mounting plate (1), which can both install and fix the second fixing block (41) and can also switch synchronously between the closed and folded states when the bottom plate (2) switches states.

8. A network security monitoring device according to claim 7, characterized in that, The connecting part includes a pull rod (81) fixedly connected to the mounting plate (1). The top end of the pull rod (81) penetrates through the first fixing block (21) and is fixedly connected to the bottom surface of the second fixing block (41). Limiting grooves (82) are opened on one side surface of the two side plates (3) close to the pull rod (81). Limiting blocks (83) are slidably connected in the limiting grooves (82), and the limiting blocks (83) are fixedly connected to the second fixing block (41). Two limiting rods (84) are fixedly connected between the two side plates (3), and the two limiting rods (84) are respectively located below the second baffle (42) and are in contact with the bottom surface of the second baffle (42).

9. The network security monitoring device according to claim 2, characterized in that, A cooling fan is installed in the first fixing block (21), and the air direction of the cooling fan is parallel to the height direction of the front plate (5) and the rear plate (6).

Images