Method and system for carrying out potential safety hazard detection on network service

Abstract

The invention belongs to the technical field of network security, and discloses a method and a system for carrying out potential safety hazard detection on network services, which carry out deep analysis, restoration and detection on network data packets in a passive monitoring mode. The network condition is continuously monitored under the condition that the network environment is not interfered, and existing potential safety hazards are found in time. According to the method, the network interface is monitored when the program is started, the features are extracted from the received data packet, the vulnerability information is searched according to the features, and the potential safety hazard is identified.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method and system for detecting potential security risks in network services. Background Art

[0002] With the widespread adoption and commercialization of the internet, a vast amount of server software exists online, running continuously and providing various network services. However, these software programs are prone to vulnerabilities and defects. According to statistics, the total number of disclosed vulnerabilities globally reached 44,957 in 2024, an increase of over 50% year-on-year, reaching a record high. High-risk / critical vulnerabilities accounted for over 50%, and 22,659 vulnerabilities directly impacting system security (including 10,873 critical vulnerabilities and 11,786 high-risk vulnerabilities) were identified. Timely detection, discovery, and remediation of software vulnerabilities and defects can reduce security risks and minimize losses. Existing detection methods primarily rely on regular port scans of target servers using detection tools. This approach has two problems: scanning can disrupt the network environment, affecting server operation; and regular scans fail to provide continuous network monitoring and identify security risks in a timely manner.

[0003] Through the above analysis, the problems and defects of the existing technology are as follows:

[0004] (1) Scanning will interfere with the network environment and affect the normal operation of the server.

[0005] (2) Regular scanning cannot continuously monitor network conditions and detect security risks in a timely manner. Summary of the Invention

[0006] In view of the problems existing in the prior art, the present invention provides a method and system for detecting security risks in network services.

[0007] The present invention is implemented as follows: a method and system for detecting security risks in network services, comprising:

[0008] Step 1: After the program starts, it starts to monitor the network interface and continuously reads data packets from the network interface;

[0009] Step 2: Perform deep parsing on each data packet to restore the protocol header and payload content;

[0010] Step 3: Use rules to extract features from the payload content;

[0011] Step 4: Search for vulnerability information in the vulnerability database based on the characteristics;

[0012] Step 5: Make a comprehensive judgment based on the vulnerability information to identify security risks; if there are risks, output an alarm log.

[0013] Another object of the present invention is to provide a system for detecting security risks in network services, comprising:

[0014] The monitoring module is used to monitor the network interface after the program starts and continuously read data packets from the network interface;

[0015] Parsing module, used to deeply parse each data packet and restore the protocol header and payload content;

[0016] Feature extraction module, used to extract features from payload content using rules;

[0017] Search module, used to search for vulnerability information in the vulnerability database based on features;

[0018] The identification module is used to make comprehensive judgments based on vulnerability information and identify security risks; if risks exist, an alarm log is output.

[0019] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for detecting security risks in network services.

[0020] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method for detecting security risks in network services.

[0021] Another object of the present invention is to provide an information data processing terminal, which is used to implement the system for detecting security risks in network services.

[0022] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0023] The purpose of the present invention is to provide a method for detecting security risks in network services. By passively monitoring, network data packets are deeply analyzed, restored and detected, so as to continuously monitor the network status and promptly discover existing security risks without interfering with the network environment.

[0024] The present invention monitors the network interface when the program is started, extracts features from received data packets, searches for vulnerability information based on the features, and identifies security risks.

[0025] Whether the technical solution of the present invention overcomes technical bias: In the field of network security, it is generally believed that continuous monitoring of network assets can timely detect risks and reduce losses. However, based on the technical bias formed by long-term practice in this field, it is believed that active scanning can effectively simulate real attack behaviors, and risks can be discovered by using tools to scan network assets. Therefore, in the existing technology, active scanning with tools is adopted. Through research, the present invention found that the use of passive monitoring methods has better detection efficiency and timeliness than active detection methods. The present invention provides a method and system for detecting security risks in network services. The key lies in analyzing network traffic and extracting features through passive monitoring to detect security risks. It overcomes the technical bias in the existing technology that active scanning for security risk detection is more efficient and timely, and achieves a 5% increase in detection efficiency while improving the timeliness of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of a method for detecting security risks in network services provided by an embodiment of the present invention.

[0027] Figure 2 This is a block diagram of the system structure for detecting security risks in network services provided by an embodiment of the present invention.

[0028] Figure 3 Schematic diagram of an IDC security monitoring and analysis platform provided by an embodiment of the present invention;

[0029] Figure 4 This is a security event and trend graph provided by an embodiment of the present invention;

[0030] Figure 5 This is a schematic diagram of event type distribution and victim hosts provided by an embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of a historical log of network security events provided by an embodiment of the present invention;

[0032] Figure 7 Detailed information diagram of a network security incident provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0034] like Figure 1 As shown, a method for detecting security risks in network services provided by an embodiment of the present invention includes the following steps:

[0035] S101, after the program is started, it starts to monitor the network interface and continuously reads data packets from the network interface;

[0036] S102, deeply analyze each data packet to restore the protocol header and payload content;

[0037] S103, extracting features from the payload content using rules;

[0038] S104, searching for vulnerability information in a vulnerability database based on the characteristics;

[0039] S105: Perform a comprehensive assessment based on the vulnerability information to identify potential safety hazards; if a potential safety hazard exists, output an alarm log.

[0040] An embodiment of the present invention provides a method for detecting security risks in network services, comprising the following detailed steps:

[0041] S101: Start the monitoring module to collect network signal data packets

[0042] After the program is initialized, it calls the underlying network driver interface (such as libpcap or WinPcap) to set the monitoring mode;

[0043] Configure monitoring network card and capture filtering rules (such as port, protocol type, etc.);

[0044] Capture raw data packets from the network interface in real time;

[0045] Buffer the data packets into the memory queue and prepare them for parsing and processing.

[0046] S102: Perform deep protocol analysis on each data packet

[0047] For each data packet in the buffer queue, protocol decoding and layered restoration are performed in sequence. The steps include:

[0048] Perform layered analysis according to the OSI model, from the physical layer to the transport layer (such as Ethernet header, IP header, TCP / UDP header);

[0049] Determine the packet type (HTTP, FTP, DNS, SMTP, etc.);

[0050] Extract application layer protocol payloads and perform semantic analysis, such as parsing HTTP request fields, parameter names, and URLs;

[0051] Supports parsing of common data transcoding such as obfuscation encoding, GZIP compression, and Base64.

[0052] S103: Extracting feature information based on rule engine

[0053] From the parsed protocol payload, key features are identified using the preset rule base:

[0054] Match specific patterns, such as SQL injection statements, XSS script features, command injection strings, etc.

[0055] Use regular expressions or feature hashing to extract key information (such as username fields, paths, and payload fragments);

[0056] Determine field type, request intent, and abnormal behavior probability based on context;

[0057] Normalize the extraction results into feature vectors or tag lists for subsequent judgment.

[0058] S104: Matching with vulnerability database

[0059] Match the extracted features with local or remote vulnerability databases (such as CVE, CNVD, or custom rule bases):

[0060] Compare attack patterns, exploit code snippets, and known vulnerability identifiers;

[0061] Introducing a fuzzy matching mechanism to address deformation attacks or zero-day vulnerability behavior characteristics;

[0062] Supports automatic updates of online vulnerability libraries to ensure that the rule base is synchronized with the latest security events in a timely manner.

[0063] S105: Risk assessment based on feature matching results

[0064] For each matching result, a multi-dimensional assessment is performed to determine whether there are any security risks:

[0065] Combines factors such as contextual behavior, traffic frequency, abnormal access paths, and IP reputation;

[0066] Machine learning models (such as random forest and SVM) can be introduced for intelligent judgment;

[0067] The final output is "high risk", "medium risk" and "low risk" level results;

[0068] If it is determined that there is a hidden danger, the alarm process is triggered.

[0069] S106: Output alarm log and record event information

[0070] When network behavior with security risks is identified, the following actions are automatically performed:

[0071] Generate event records with detailed information in the log system (timestamp, source IP, destination port, attack type, triggering rules, etc.);

[0072] Can be configured to automatically report to SIEM security event management system or trigger firewall linkage action;

[0073] Alarm logs are persistently stored or pushed in real time in JSON, XML or syslog format;

[0074] Supports real-time viewing of alarm records and risk trends through a graphical interface.

[0075] like Figure 2 As shown, an embodiment of the present invention provides a system for detecting security risks in network services, including:

[0076] The monitoring module is used to monitor the network interface after the program starts and continuously read data packets from the network interface;

[0077] Parsing module, used to deeply parse each data packet and restore the protocol header and payload content;

[0078] Feature extraction module, used to extract features from payload content using rules;

[0079] Search module, used to search for vulnerability information in the vulnerability database based on features;

[0080] The identification module is used to make comprehensive judgments based on vulnerability information and identify security risks; if risks exist, an alarm log is output.

[0081] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for detecting security risks in network services.

[0082] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method for detecting security risks in network services.

[0083] Another object of the present invention is to provide an information data processing terminal, which is used to implement the system for detecting security risks in network services.

[0084] This invention has been successfully applied in the telecommunications operator environment to a product for analyzing network traffic and security monitoring: the "IDC Security Monitoring and Analysis Platform."

[0085] like Figure 3As shown in the figure, with IDC room users as the dimension, the collection and analysis of multi-source full-volume logs and traffic correlation analysis are the core to achieve visualization of the entire life cycle of IDC user traffic; combined with threat intelligence analysis and correlation of IDC user traffic, security portrait analysis of 1DC room users is achieved. At the same time, security solutions and security product services are proposed for threat evidence collection and tracing.

[0086] Provide value-added analysis functions for IDCISP information security projects.

[0087] 1. If Figure 4 As shown in the figure, by continuously monitoring and analyzing network traffic, security events and trend charts are counted and displayed.

[0088] 2. If Figure 5 As shown, it detects and discovers various security incidents and network risks, and counts the distribution of incident types and victim hosts.

[0089] 3. If Figure 6 、 Figure 7 As shown, it displays the historical logs and detailed information of network security events.

[0090] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without the need for creative work are still within the scope of protection of the present invention.

Claims

1. A method for detecting security risks in network services, characterized in that: The following steps are involved:   S101, monitoring the network interface and collecting network data packets in real time;   S102, performing protocol layer analysis on each collected network data packet to extract the protocol header and payload content; S103: Extract features from the payload content based on preset rules to identify potential attack behaviors;   S104, matching the extracted features with known vulnerability information in the vulnerability database; S105. Comprehensively determine whether there are safety hazards based on the matching results; S106: When it is determined that there is a potential safety hazard, a corresponding alarm log is generated and output.

2. The method according to claim 1, characterized in that In S102, the protocol layer parsing includes layered restoration of the Ethernet header, IP header, TCP / UDP header and application layer protocol fields, and supports semantic parsing of protocols such as HTTP, FTP, DNS, and SMTP.

3. The method according to claim 1, characterized in that In S103, the feature extraction uses regular expression matching, feature hash recognition or pre-training model to tokenize abnormal keywords, request paths, and parameter formats.

4. The method according to claim 1, wherein The comprehensive judgment in S105 includes performing multi-factor judgment based on contextual behavior, access frequency, IP reputation level, and attack feature score, outputting risk level results, and calling the defense system to execute a linkage response.

5. A system for detecting security risks of network services implementing the method for detecting security risks of network services as claimed in claim 1, characterized in that: The system for detecting potential security risks in network services includes: The monitoring module is used to monitor the network interface after the program starts and continuously read data packets from the network interface; Parsing module, used to deeply parse each data packet and restore the protocol header and payload content; Feature extraction module, used to extract features from payload content using rules; Search module, used to search for vulnerability information in the vulnerability database based on features; The identification module is used to make comprehensive judgments based on vulnerability information and identify security risks; if risks exist, an alarm log is output.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for detecting security risks in network services as claimed in claim 1.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the method for detecting security risks in network services according to claim 1.

8. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the system for detecting security risks of network services as described in claim 2.

Images