Hybrid network security communication early warning method and signaling interworking gateway

Abstract

The invention discloses a hybrid network security communication early warning method and a signaling interworking gateway. The method comprises the steps that a target Pcap file of a target hybrid network in a preset time period is acquired, and the target Pcap file comprises a plurality of target data packets during signaling interaction between core network elements in the target hybrid network; analyzing each target data packet in the target Pcap file to obtain a traffic feature set and a data feature set of the target Pcap file; analyzing the traffic feature set and the data feature set of the target Pcap file by using an abnormal traffic risk assessment model to obtain an abnormal traffic risk score of the target hybrid network in a preset time period; and sending early warning prompt information matched with the abnormal traffic risk score to a management terminal. According to the method and the device, the technical problem that the abnormal traffic risk condition of the hybrid network cannot be accurately analyzed by the fixed traffic rule and attack feature library in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the field of network management technology, and in particular to a hybrid network security communication early warning method and a signaling intercommunication gateway. Background Art

[0002] In the 5G network environment, with the deep integration of enterprise private networks and large networks, a complex hybrid network architecture has been formed. Although this architecture enhances the flexibility and functionality of the network, it also brings many problems in network security, operator management, etc. In order to overcome these problems, the Customized-Inter Working Function (C-IWF) came into being. Its position in the network is as follows. Figure 1 As shown, the signaling intercommunication gateway is a key node for signaling intercommunication between the large network and the specific private network. It undertakes a large number of signaling interaction and data transmission tasks, which is crucial for traffic monitoring and analysis between hybrid networks.

[0003] However, in terms of network security protection, the existing technology analyzes abnormal traffic patterns and / or attack behaviors based on fixed traffic rules and / or attack feature libraries, resulting in a slower response to abnormal traffic patterns and attack behaviors. In addition, the existing technology does not deeply explore the deep connections behind traffic patterns and attack behaviors, resulting in poor accuracy in analyzing abnormal traffic risk situations in hybrid networks, thereby hindering secure communication management in hybrid network environments, increasing the burden on network operators, and reducing the overall security and stability of the network.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present application provide a hybrid network security communication early warning method and a signaling intercommunication gateway to solve the technical problem that the fixed traffic rules and attack feature libraries of related technologies cannot accurately analyze the abnormal traffic risk situation of the hybrid network.

[0006] According to one aspect of an embodiment of the present application, a hybrid network communication security early warning method is provided, including: obtaining a target Pcap file of a target hybrid network within a preset time period, wherein the target Pcap file includes multiple target data packets when signaling interaction is performed between core network elements in the target hybrid network; parsing each target data packet in the target Pcap file to obtain a traffic feature set and a data feature set of the target Pcap file; using an abnormal traffic risk assessment model to analyze the traffic feature set and the data feature set of the target Pcap file to obtain an abnormal traffic risk score of the target hybrid network within the preset time period, wherein the abnormal traffic risk score is used to reflect the degree of impact of attack behavior of the target hybrid network within the preset time period on the target hybrid network security communication; and sending early warning prompt information matching the abnormal traffic risk score to a management terminal.

[0007] Optionally, obtaining a target Pcap file of the target hybrid network within a preset time period includes: obtaining an initial Pcap file of the target hybrid network within a preset time period, wherein the initial Pcap file includes at least: multiple data packets when the core network elements of the large network and the target private network in the target hybrid network perform signaling interaction within the preset time period, and the types of the data packets include at least one of the following: IP data packets, control plane protocol data packets related to control plane network elements, user plane protocol data packets related to user plane network elements, domain name resolution data packets, dynamic host configuration protocol data packets, and simple network management protocol data packets; performing signaling on each data packet in the initial Pcap file Parse to obtain the data packet content of each data packet, wherein the data packet content includes at least: data link layer information, network layer information, transport layer information, and the data link layer information includes at least: source Mac address, destination Mac address, the network layer information includes at least: source IP address, destination IP address, protocol type, and the transport layer information includes at least: source port, destination port; based on the data packet content of each data packet, filter the initial Pcap file to obtain the target Pcap file, wherein the types of target data packets in the target Pcap file include: control plane protocol data packets related to control plane network elements, and user plane protocol data packets related to user plane network elements.

[0008] Optionally, based on the data packet content of each data packet, the initial Pcap file is filtered to obtain a target Pcap file, including: filtering multiple data packets in the initial Pcap file according to the protocol type, and forming the target Pcap file with target data packets transmitted based on the control plane protocol or target data packets transmitted based on the user plane protocol, wherein the control plane protocol includes at least one of the following: Hypertext Transfer Protocol HTTP, Packet Forwarding Control Protocol, and the user plane protocol includes at least one of the following: General Packet Radio Service Tunneling Protocol-User Plane Protocol, Transmission Control Protocol, User Datagram Protocol; or, filtering multiple data packets in the initial Pcap file according to the transceiver identification information, and forming the target Pcap file with target data packets whose transceiver identification information points to the control plane network element and / or user plane network element in the target hybrid network, wherein the transceiver identification information includes: source Mac address, destination Mac address, source IP address, destination IP address, source port, and destination port.

[0009] Optionally, the traffic feature set includes at least: traffic size, traffic rate, traffic distribution, and traffic duration, wherein each data packet in the target Pcap file is parsed to obtain the traffic feature set and data feature set of the target Pcap file, including: reading each target data packet in the target Pcap file, parsing the target data packet, and obtaining the corresponding data packet header and data packet content, wherein the data packet header includes at least: data packet capture timestamp, total data packet length, and actual captured data packet length, and the data packet content also includes: payload content; using the data packet content of each target data packet in the target Pcap file as the data feature set of the target Pcap file; taking the sum of the total data packet lengths of all target data packets in the target Pcap file as the traffic size of the target Pcap file; determining the timestamp difference between the capture timestamp of the first target data packet and the capture timestamp of the last target data packet in the target Pcap file, and taking the timestamp difference as the traffic duration of the target Pcap file; dividing the traffic size by the traffic duration to obtain the average traffic rate of the target Pcap file; determining the traffic proportion of different transceivers based on the transceiver identification information and total data packet length of each target data packet in the target Pcap file.

[0010] Optionally, the training process of the abnormal traffic risk assessment model includes: obtaining multiple groups of training sample data, wherein each group of training sample data includes: using the traffic feature set and data feature set of historical Pcap files of the hybrid network in multiple historical time periods as training samples, and using the abnormal traffic risk scores of the hybrid network in each historical time period as sample labels of corresponding training samples; determining a neural network model, wherein the neural network model includes at least: an abnormal traffic behavior recognition network and an attack behavior recognition network; and iteratively training the neural network model using multiple groups of training sample data to obtain an abnormal traffic risk assessment model.

[0011] Optionally, multiple sets of training sample data are obtained, including: in each historical time period, obtaining a historical Pcap file of the hybrid network in the historical time period, and parsing each data packet in the historical Pcap file to obtain a traffic feature set and a data feature set of the historical Pcap file respectively; determining whether the hybrid network has an abnormal traffic pattern in the historical time period based on the size relationship between the traffic feature set of the historical Pcap file and a preset normal traffic feature baseline set; when the hybrid network does not have an abnormal traffic pattern in the historical time period, recording the abnormal traffic risk score of the hybrid network in the historical time period as the lowest score; when the hybrid network has an abnormal traffic pattern in the historical time period, determining at least one target attack behavior of the hybrid network in the historical time period and the risk score corresponding to each target attack behavior based on the matching result of the data feature set of the historical Pcap file and a preset attack behavior feature library, and taking the average value of the risk score corresponding to each target attack behavior as the abnormal traffic risk score of the historical Pcap file, wherein the attack behavior feature library stores data feature sets and risk scores corresponding to multiple types of attack behaviors, and the risk score is determined at least by the severity, frequency, and impact range of the attack behavior.

[0012] Optionally, sending early warning prompt information matching the abnormal traffic risk score to the management terminal includes: when the abnormal traffic risk score is higher than a preset risk score threshold, sending a first early warning prompt information to the management terminal, wherein the first early warning prompt information at least includes: the indicator light flashes at a first frequency, and the buzzer emits a prompt sound at a first frequency and a first volume; when the abnormal traffic risk score is not higher than the preset risk score threshold, sending a second early warning prompt information to the management terminal, wherein the second early warning prompt information at least includes: the indicator light flashes at a second frequency, and the buzzer emits a prompt sound at a second frequency and a second volume; wherein the first frequency is higher than the second frequency, and the first volume is higher than the second volume.

[0013] According to another aspect of an embodiment of the present application, a signaling intercommunication gateway is also provided, including: an acquisition module, used to obtain a target Pcap file of a target hybrid network within a preset time period, wherein the target Pcap file includes multiple target data packets when signaling interaction is performed between core network elements in the target hybrid network; a parsing module, used to parse each target data packet in the target Pcap file to obtain a traffic feature set and a data feature set of the target Pcap file; a risk assessment module, used to analyze the traffic feature set and the data feature set of the target Pcap file using an abnormal traffic risk assessment model to obtain an abnormal traffic risk score of the target hybrid network within a preset time period, wherein the abnormal traffic risk score is used to reflect the degree of impact of the attack behavior of the target hybrid network within the preset time period on the secure communication of the target hybrid network; and an early warning module, used to send early warning prompt information matching the abnormal traffic risk score to the management terminal.

[0014] According to another aspect of an embodiment of the present application, a computer program product is further provided, comprising: a computer program, wherein when the computer program is executed by a processor, the above-mentioned hybrid network security communication early warning method is implemented.

[0015] According to another aspect of an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned hybrid network security communication early warning method through the computer program.

[0016] In an embodiment of the present application, the signaling intercommunication gateway parses each target data packet in the target PCAP file of the target hybrid network within a preset time period to obtain a traffic feature set and a data feature set. It then uses an abnormal traffic risk assessment model to analyze the abnormal traffic risk score and finally sends a warning message matching the abnormal traffic risk score to the management terminal. This achieves the technical effect of in-depth monitoring and risk quantification of signaling interactions between core network elements in a hybrid network, achieving the goals of ensuring hybrid network communication security, maintaining network stability, and improving service quality. This further addresses the technical problem that the fixed traffic rules and attack feature libraries of related technologies cannot accurately analyze the abnormal traffic risk situation in hybrid networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 It is a structural diagram of an optional hybrid network of the related art;

[0019] Figure 2 This is a flow chart of an optional hybrid network security communication early warning method according to an embodiment of the present application;

[0020] Figure 3 is a schematic structural diagram of an optional signaling intercommunication gateway according to an embodiment of the present application;

[0021] Figure 4 It is a schematic structural diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0023] It should be noted that the terms "first", "second", etc. in the specification, claims, and drawings of the present application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0024] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:

[0025] C-IWF (Customized-Inter Working Function): A network device used to transmit and convert signaling information between different types of networks. Its main function is to convert signaling information from one network into the signaling protocol used by another network and then transmit the converted signaling information to the target network.

[0026] 5GC (5th Generation Core Network): is the core part of the 5G network, responsible for processing and managing data flows, user sessions, access management, network slicing and other functions in the 5G network.

[0027] Access and Mobility Management Function (AMF): Responsible for user access to the network, including initial access, reselection, handover, and other mobility management operations. The AMF also handles signaling interactions with user equipment (UE), supporting functions such as call establishment and location tracking.

[0028] SMF (Session Management Function): Responsible for session management and policy control. The SMF manages user data sessions, including session establishment, modification, and release. It also interacts with the UPF (User Plane Function) to configure the routing and policies for user data plane traffic.

[0029] UPF (User Plane Function): Handles traffic on the user data plane. The UPF is responsible for forwarding and processing user data, including packet routing, caching, and traffic metering. It manages user data flows based on the SMF configuration.

[0030] Unified Data Management (UDM): Manages user data and subscription information. It provides user subscription data, authentication information, and policies, supporting user authentication and service configuration.

[0031] AUSF (Authentication Server Function): Responsible for user identity authentication. The AUSF processes user authentication requests and ensures that only authenticated users can access network resources. It interacts with the AMF and UDM network elements to complete the user authentication process.

[0032] DN (Data Network): refers to the network within an enterprise private network or the part of a service provider's network that provides services to end users. It can be an internal local area network (LAN), a data center network, a private cloud environment, or any network infrastructure that provides specific services and applications.

[0033] NRF (Network Repository Function): Serves as a registration and discovery mechanism for network functions. NRF provides a unified repository that stores information about network functions, making it easy for other network functions to discover and access these services.

[0034] Pcap (Packet Capture): A file format for capturing network data packets, widely used in network analysis and troubleshooting. It records every packet in network communications and stores it in a file for subsequent analysis. Therefore, a Pcap file consists of three main parts: the Pcap Header (which contains basic file information such as version number, timestamp accuracy, maximum storage length, and link type); the Packet Header (which contains information such as the time, capture length, and actual length of each packet); and the Packet Data (the actual packet contents).

[0035] Example 1

[0036] According to an embodiment of the present application, a hybrid network security communication early warning method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] Figure 2 Schematic diagram of a hybrid network security communication early warning method according to an embodiment of the present application. Figure 2 As shown, the method includes the following steps:

[0038] Step S202: Obtain a target Pcap file of the target hybrid network within a preset time period.

[0039] Among them, the target hybrid network is composed of a large network and a specific private network. The target Pcap file refers to multiple data packets during signaling interaction between the core network elements of the large network and the specific private network in the target hybrid network. These data packets can comprehensively and real-time reflect the network communication information of the target hybrid network within a preset time period.

[0040] Step S204: parse each data packet in the target Pcap file to obtain a flow characteristic set and a data characteristic set of the target Pcap file.

[0041] The traffic feature set includes, but is not limited to, traffic volume, traffic rate, number of session connections, and other information, while the data feature set includes, but is not limited to, communication type, session status, potential abnormal behavior patterns, and other information. This information can provide data support for subsequent anomaly analysis.

[0042] Step S206: Analyze the traffic feature set and data feature set of the target Pcap file using the pre-trained abnormal traffic risk assessment model to obtain an abnormal traffic risk score of the target hybrid network within a preset time period.

[0043] Among them, the above-mentioned abnormal traffic risk score is used to reflect the impact of the attack behavior of the target hybrid network within a preset time period on the secure communication of the target hybrid network.

[0044] Step S208: Sending warning information that matches the abnormal traffic risk score to the management terminal.

[0045] Among them, the early warning prompt information is the process of sending early warning information to the network management terminal in real time through multiple communication channels and display methods based on the assessed abnormal traffic risk score.

[0046] Based on the solution defined in steps S202 through S208 above, the signaling intercommunication gateway parses each target data packet within the target PCAP file of the target hybrid network within a preset time period to obtain a traffic feature set and a data feature set. It then uses the abnormal traffic risk assessment model to analyze the abnormal traffic risk score and finally sends a warning message matching the abnormal traffic risk score to the management terminal. This achieves the technical effect of in-depth monitoring and risk quantification of signaling interactions between core network elements in the hybrid network, ensuring hybrid network communication security, maintaining network stability, and improving service quality.

[0047] The following describes the steps of the hybrid network security communication early warning method applied to the signaling interworking gateway C-IWF in conjunction with a specific implementation process.

[0048] As an optional implementation, in the technical solution provided in the above step S202, the method may include:

[0049] Step S2021: Obtain an initial Pcap file of the target hybrid network within a preset time period.

[0050] In the technical solution provided in the above step S2021, the signaling intercommunication gateway C-IWF includes multiple subtypes for processing different types of network traffic, such as the N4-P subsystem for processing PFCP (Packet Forwarding Control Protocol) traffic on the N4 interface, the SBI-P subsystem for processing HTTP / 2 traffic based on the service-based interface SBI, etc. These subsystems undertake the important task of traffic capture. Therefore, the C-IWF can use these subsystems to capture multiple data packets when the core network elements of the large network and the target private network in the target hybrid network perform signaling interactions within a preset time period. Therefore, the types of data packets in the initial Pcap file include but are not limited to: IP data packets, control plane protocol data packets related to control plane network elements (such as PFCP, HTTP2, SIP protocol data packets), user plane protocol data packets related to user plane network elements (such as GTP-U, UDP data packets), domain name resolution data packets, Dynamic Host Configuration Protocol (DHCP) data packets, and Simple Network Management Protocol (SNMP) data packets.

[0051] by Figure 1 As shown in the network structure diagram shown, C-IWF can use the N4-P subsystem to process the communication between the SMF network elements in a specific enterprise private network and the sinking edge UPF network elements using the PFCP protocol. The N4-P subsystem will monitor these communications and capture all data packets transmitted by the N4 interface in real time; and when the SBI-P subsystem processes the communication between the core network network elements (such as AUSF, UDM, AMF, NRF) in the large network and the core network network elements (such as AMF, SMF, etc.) in the sinking private network using the HTTP2 protocol, the SBI-P subsystem will monitor these communications and capture all data packets transmitted by specific interfaces (such as N14, N11 and other control plane interfaces) in real time.

[0052] Step S2022: parse each data packet in the initial Pcap file to obtain the data packet content of each data packet.

[0053] The data packet content includes at least: data link layer information, network layer information, and transport layer information. The data packet content obtained by parsing the data packet contains all data from the link layer to the application layer. Therefore, the data packet content includes at least: data link layer header information (i.e., encapsulated network layer information, such as the source MAC address, destination MAC address, and Ethernet type) in the link layer information; network layer header information (i.e., encapsulated upper layer protocol data, such as the source IP address, destination IP address, and protocol type) in the network layer information; transport layer information (i.e., actual transmitted user data, such as the source port, destination port, sequence number, acknowledgment number, etc.); and application layer information (i.e., different request or response contents, such as HTTP request / response, FTP command / response, and DNS query / response).

[0054] It should be noted that regarding protocol parsing, C-IWF can call a special protocol parsing library to perform in-depth parsing of each data packet in the initial Pcap file to obtain their respective protocol types. As for address parsing, when data packets are transmitted through the network through C-IWF, due to security or other requirements, C-IWF may convert or hide the source address or destination address in some signaling or data packets, and record them separately in an address conversion record table maintained internally by C-IWF (recording the address information before and after the conversion) to protect the privacy and security within the network. Therefore, during the Pcap file parsing process, if a data packet with a hidden address is encountered, the corresponding original address can be found by querying this address conversion record table, thereby restoring the hidden address.

[0055] Step S2023: Filter the initial Pcap file based on the data packet content of each data packet to obtain a target Pcap file.

[0056] The technical solution provided in step S2023 above is that the C-IWF can filter the initial Pcap file based on the protocol type or the transceiver identification information. The specific implementation method is as follows:

[0057] The multiple data packets in the initial Pcap file are filtered according to the protocol type, and the target Pcap file is composed of the data packets transmitted based on the control plane protocol or the data packets transmitted based on the user plane protocol.

[0058] That is, the data packets transmitted based on the control plane protocol and the user plane protocol in the initial Pcap file are filtered out to form the target Pcap file. The control plane protocols include but are not limited to the Hypertext Transfer Protocol (HTTP) and the Packet Forwarding Control Protocol (PFCP); the user plane protocols include but are not limited to the GPRS (General Packet Radio Service) Tunneling Protocol-User Plane Protocol, Transmission Control Protocol, Packet Data Convergence Protocol (PDCP), and Media Access Control (MAC) protocols.

[0059] Alternatively, multiple data packets in the initial Pcap file are filtered according to the transceiver identification information, and the data packets whose transceiver identification information points to the control plane network element and / or user plane network element in the target hybrid network form the target Pcap file.

[0060] That is, the data packets related to the control plane network elements and / or user plane network elements in the target hybrid network based on the transceiver identification information in the initial Pcap file are filtered out to form the target Pcap file. The transceiver identification information includes: source MAC address, destination MAC address, source IP address, destination IP address, source port, and destination port.

[0061] After this filtering operation, the C-IWF obtains a target Pcap file that concentrates on packets related to control and user plane network elements, allowing it to perform anomaly analysis on the target Pcap file. Compared to directly analyzing anomalies on the initial Pcap file, filtering the Pcap file removes packets irrelevant to the current analysis task, focusing analysis on packets related to core network elements and improving the speed and accuracy of data analysis.

[0062] Furthermore, the C-IWF may parse each data packet in the target Pcap file to obtain a flow characteristic set and a data characteristic set of the target Pcap file.

[0063] As an optional implementation, in the technical solution provided in step S204 above, the C-IWF may obtain the traffic feature set and data feature set of the target Pcap file through the following steps, including:

[0064] Step S2041, read each data packet in the target Pcap file, parse the data packet, and obtain the corresponding data packet header and data packet content.

[0065] Among them, the data packet header includes: data packet capture timestamp (Timestamp), total length of the data packet (PacketLength), actual captured data packet length (Capture Length); and the data packet content includes at least: link layer information (i.e. the outermost layer of the data packet) includes at least: source Mac address, destination Mac address, frame type and other information; network layer information (located above the data link layer) includes at least: source IP address, destination IP address, protocol type (such as TCP, UDP, Internet Control Message Protocol ICMP, etc.), TTL (Time to Live, survival time) and other information; transport layer information (above the network layer) includes at least: source port, destination port, sequence number, acknowledgment number, window size and other information.

[0066] Step S2042, using the data packet content of each target data packet in the target Pcap file as the data feature set of the target Pcap file. Also, the key fields in the data packet content corresponding to each target data packet in the target Pcap file are used as the data feature set.

[0067] Step S2043, taking the sum of the total lengths of all target data packets in the target Pcap file as the flow size of the target Pcap file; determining the timestamp difference between the capture timestamp of the first target data packet and the capture timestamp of the last target data packet in the target Pcap file, and taking the timestamp difference as the flow duration of the target Pcap file; dividing the flow size by the flow duration to obtain the average flow rate of the target Pcap file; determining the flow proportion of different transceivers (such as AMF, SMF, UPF and other network elements) based on the transceiver identification information and the total length of the data packets of each target data packet in the target Pcap file, that is, by counting the total number of bytes of the data packets involved in each transceiver, and then calculating its proportion of the total flow size.

[0068] It should be noted that the embodiment of the present application does not impose any specific restrictions on the execution order of the above-mentioned step S2042 and step S2043. The above-mentioned execution of step S2042 first and then step S2043 is only an optional method.

[0069] Furthermore, C-IWF can input the traffic feature set and data feature set of the target Pcap file into the abnormal traffic risk assessment model. The abnormal traffic risk assessment model can evaluate whether the traffic feature set and data feature set conform to the normal traffic pattern, thereby generating an abnormal traffic risk score, which represents the potential abnormal risk of the target hybrid network within a preset time period.

[0070] Optionally, regarding the above abnormal traffic risk assessment model, its training process is specifically as follows:

[0071] Step 1: Obtain multiple sets of training sample data. Each set of training sample data includes: the traffic feature set and data feature set of historical Pcap files of the hybrid network in multiple historical (operational) time periods as training samples, and the abnormal traffic risk score of the hybrid network in each historical time period as the sample label of the corresponding training sample.

[0072] Specifically, in the technical solution provided in the first step above, the acquisition of training sample data can be achieved through the following steps:

[0073] First, in each historical time period, the historical Pcap file of the hybrid network in the historical time period is obtained, and each data packet in the historical Pcap file is parsed to obtain the traffic feature set (such as traffic size, traffic rate, traffic distribution, traffic duration, etc.) and data feature set (such as communication protocol, source / destination address, load content, etc.) of the historical Pcap file.

[0074] Next, based on the size relationship between the traffic feature set of the historical Pcap file and the preset normal traffic feature baseline set, it is determined whether the hybrid network has abnormal traffic patterns during the historical time period. Among them, the normal traffic feature baseline set is constructed by statistically analyzing the traffic feature sets of a large number of historical normal Pcap files, which represents the typical behavior and distribution of network traffic under normal conditions. Therefore, this application compares each traffic feature in the traffic feature set of the historical Pcap file with the normal traffic feature baseline set item by item to determine whether the hybrid network has abnormal traffic during the historical time period.

[0075] When there is no abnormal traffic pattern in the hybrid network during the historical time period, that is, the traffic of the hybrid network during the historical time period completely conforms to the preset normal behavior pattern, the abnormal traffic risk score of the hybrid network during the historical time period can be recorded as the lowest score.

[0076] When an abnormal traffic pattern exists in a hybrid network within a historical time period, at least one target attack behavior of the hybrid network within the historical time period and the risk score corresponding to each target attack behavior are determined based on the matching results of the data feature set of the historical Pcap file and the preset attack behavior feature library, and the average value of the risk scores corresponding to each target attack behavior is used as the abnormal traffic risk score of the historical Pcap file.

[0077] Among them, the attack behavior feature library stores multiple types of attack behaviors, such as denial of service attacks, distributed denial of service (DDoS) attacks, malicious scanning attacks, SQL injection attacks, worm attacks, etc., and their corresponding data feature sets and risk scores. The risk score is determined at least by the severity, frequency, and scope of impact of the attack behavior.

[0078] Step 2: Determine the neural network model. The neural network model must include at least an abnormal traffic behavior recognition network and an attack behavior recognition network. The abnormal traffic behavior recognition network is a sub-model used to identify abnormal traffic behavior. Its structure can be a convolutional neural network (CNN), a recurrent neural network (RNN), or other network structures suitable for processing sequential data. The attack behavior recognition network is a sub-model specifically used to identify attack behaviors. Its structure can be a deep learning architecture such as a long short-term memory network (LSTM) or a gated recurrent unit (GRU), thereby identifying complex attack patterns.

[0079] Step 3: Iteratively train the neural network model using multiple sets of training sample data to obtain an abnormal traffic risk assessment model. During each iteration, the model parameters are continuously updated to minimize the loss function between the predicted abnormal traffic risk score and the true sample label.

[0080] Therefore, the abnormal traffic risk assessment model trained by the above method can accurately identify potential attack behaviors based on the in-depth analysis of historical Pcap files, and achieve a refined assessment of abnormal traffic risk scores by quantifying the severity, frequency and impact range of various attack behaviors.

[0081] As an optional implementation, in the technical solution provided in step S208 above, the C-IWF may send a warning message matching the abnormal traffic risk score to the management terminal according to the following rules:

[0082] When the abnormal traffic risk score is higher than the preset risk score threshold, the warning level can be determined to be "high". At this time, the C-IWF can send a first warning prompt message to the management terminal (i.e., the terminal device of the manager). The first warning prompt message can be designed to flash an indicator light at a first frequency and emit a buzzer at a first frequency and a first volume to attract the attention of the management terminal and convey the emergency warning information.

[0083] If the abnormal traffic risk score is not higher than the preset risk score threshold, the warning level can be determined to be "low". At this time, the C-IWF can send a second warning prompt message to the management terminal. The second warning prompt message can be designed to flash the indicator light at a second frequency and emit a buzzer at a second frequency and second volume, thereby notifying the management terminal that the network status is within the normal range and still requires attention.

[0084] The first frequency is higher than the second frequency, and the first volume is higher than the second volume. It should be noted that warning information can also be fed back via SMS, email, instant messaging, and other means. Based on the severity of the abnormal traffic risk score, C-IWF can also send warning information to managers at different levels, such as frontline operations personnel, senior network engineers, and security managers, to ensure timely communication and response.

[0085] Therefore, by periodically executing the above-mentioned hybrid network security communication early warning method, C-IWF can help network managers better understand the security status of the hybrid network, ensure that managers can respond quickly, thereby effectively improving the efficiency of network security management and emergency response, and ensuring the stable operation and data security of the hybrid network.

[0086] Example 2

[0087] According to the embodiment of the present application, a signaling intercommunication gateway for implementing the hybrid network security communication early warning method in embodiment 1 is also provided. Figure 3 As shown, the signaling intercommunication gateway includes at least: an acquisition module 32, a parsing module 34, a risk assessment module 36 and an early warning module 38, wherein:

[0088] An acquisition module 32 is configured to acquire a target Pcap file of a target hybrid network within a preset time period, wherein the target Pcap file includes multiple target data packets during signaling interaction between core network elements in the target hybrid network;

[0089] The parsing module 34 is used to parse each target data packet in the target Pcap file to obtain the flow characteristic set and data characteristic set of the target Pcap file;

[0090] A risk assessment module 36 is configured to analyze the traffic feature set and data feature set of the target Pcap file using an abnormal traffic risk assessment model to obtain an abnormal traffic risk score for the target hybrid network within a preset time period, wherein the abnormal traffic risk score is used to reflect the degree of impact of attack behaviors on the target hybrid network security and communication within the preset time period;

[0091] The early warning module 38 is used to send early warning prompt information matching the abnormal traffic risk score to the management terminal.

[0092] The following describes the functions of each module of the signaling intercommunication gateway in conjunction with the specific implementation process.

[0093] First, the acquisition module 32 can obtain the target Pcap file according to the following steps, including:

[0094] Step 1: Obtain the initial Pcap file of the target hybrid network within a preset time period.

[0095] In the technical solution provided in the first step above, the acquisition module 32 can capture multiple data packets when the core network elements of the large network and the target private network in the target hybrid network perform signaling interactions within a preset time period. Therefore, the types of data packets in the initial Pcap file include but are not limited to: IP data packets, control plane protocol data packets related to control plane network elements (such as PFCP, HTTP2, SIP protocol data packets), user plane protocol data packets related to user plane network elements (such as GTP-U, UDP data packets), domain name resolution data packets, Dynamic Host Configuration Protocol (DHCP) data packets, and Simple Network Management Protocol (SNMP) data packets.

[0096] Step 2: Parse each data packet in the initial Pcap file to obtain the data packet content of each data packet.

[0097] The data packet content includes at least: data link layer information, network layer information, and transport layer information. The data packet content obtained by parsing the data packet contains all data from the link layer to the application layer. Therefore, the data packet content includes at least: data link layer header information (i.e., encapsulated network layer information, such as the source MAC address, destination MAC address, and Ethernet type) in the link layer information; network layer header information (i.e., encapsulated upper layer protocol data, such as the source IP address, destination IP address, and protocol type) in the network layer information; transport layer information (i.e., actual transmitted user data, such as the source port, destination port, sequence number, acknowledgment number, etc.); and application layer information (i.e., different request or response contents, such as HTTP request / response, FTP command / response, and DNS query / response).

[0098] Step 3: Based on the data packet content of each data packet, the initial Pcap file is filtered to obtain the target Pcap file.

[0099] The technical solution provided in the third step above is that the acquisition module 32 can filter the initial Pcap file based on the protocol type or the transceiver identification information, and the specific implementation method is as follows:

[0100] The multiple data packets in the initial Pcap file are filtered according to the protocol type, and the target Pcap file is composed of the data packets transmitted based on the control plane protocol or the data packets transmitted based on the user plane protocol.

[0101] That is, the data packets transmitted based on the control plane protocol and the user plane protocol in the initial Pcap file are filtered out to form the target Pcap file. The control plane protocols include but are not limited to the Hypertext Transfer Protocol (HTTP) and the Packet Forwarding Control Protocol (PFCP); the user plane protocols include but are not limited to the GPRS (General Packet Radio Service) Tunneling Protocol-User Plane Protocol, Transmission Control Protocol, Packet Data Convergence Protocol (PDCP), and Media Access Control (MAC) protocols.

[0102] Alternatively, multiple data packets in the initial Pcap file are filtered according to the transceiver identification information, and the data packets whose transceiver identification information points to the control plane network element and / or user plane network element in the target hybrid network form the target Pcap file.

[0103] That is, the data packets related to the control plane network elements and / or user plane network elements in the target hybrid network based on the transceiver identification information in the initial Pcap file are filtered out to form the target Pcap file. The transceiver identification information includes: source MAC address, destination MAC address, source IP address, destination IP address, source port, and destination port.

[0104] After the above screening operation, the acquisition module 32 can obtain the target Pcap file that concentrates on the data packets related to the control plane and user plane network elements.

[0105] Furthermore, the parsing module 34 can obtain the traffic feature set and data feature set of the target Pcap file through the following steps, including:

[0106] Step 1: Read each data packet in the target Pcap file, parse the data packet, and obtain the corresponding data packet header and data packet content.

[0107] Among them, the data packet header includes: data packet capture timestamp (Timestamp), total length of the data packet (PacketLength), actual captured data packet length (Capture Length); and the data packet content includes at least: link layer information (i.e. the outermost layer of the data packet) includes at least: source Mac address, destination Mac address, frame type and other information; network layer information (located above the data link layer) includes at least: source IP address, destination IP address, protocol type (such as TCP, UDP, Internet Control Message Protocol ICMP, etc.), TTL (Time to Live, survival time) and other information; transport layer information (above the network layer) includes at least: source port, destination port, sequence number, acknowledgment number, window size and other information.

[0108] Step 2: The data packet content of each target data packet in the target Pcap file is used as the data feature set of the target Pcap file. That is, the key fields in the data packet content corresponding to each target data packet in the target Pcap file are used as the data feature set.

[0109] Step 3: Take the sum of the total lengths of all target data packets in the target Pcap file as the flow size of the target Pcap file; determine the timestamp difference between the capture timestamp of the first target data packet and the capture timestamp of the last target data packet in the target Pcap file, and use the timestamp difference as the flow duration of the target Pcap file; divide the flow size by the flow duration to obtain the average flow rate of the target Pcap file; determine the flow proportion of different transceivers (such as AMF, SMF, UPF and other network elements) based on the transceiver identification information and total data packet length of each target data packet in the target Pcap file, that is, by counting the total number of bytes of data packets involved in each transceiver, and then calculating its proportion of the total flow size.

[0110] Furthermore, the risk assessment module 36 can input the traffic feature set and data feature set of the target Pcap file into the abnormal traffic risk assessment model. The abnormal traffic risk assessment model can evaluate whether the traffic feature set and data feature set conform to the normal traffic pattern, thereby generating an abnormal traffic risk score, which represents the potential abnormal risk of the target hybrid network within a preset time period.

[0111] Optionally, regarding the above abnormal traffic risk assessment model, its training process is specifically as follows:

[0112] Step 1: Obtain multiple sets of training sample data. Each set of training sample data includes: the traffic feature set and data feature set of historical Pcap files of the hybrid network in multiple historical (operational) time periods as training samples, and the abnormal traffic risk score of the hybrid network in each historical time period as the sample label of the corresponding training sample.

[0113] Specifically, in the technical solution provided in the first step above, the acquisition of training sample data can be achieved through the following steps:

[0114] First, in each historical time period, the historical Pcap file of the hybrid network in the historical time period is obtained, and each data packet in the historical Pcap file is parsed to obtain the traffic feature set (such as traffic size, traffic rate, traffic distribution, traffic duration, etc.) and data feature set (such as communication protocol, source / destination address, load content, etc.) of the historical Pcap file.

[0115] Next, based on the size relationship between the traffic feature set of the historical Pcap file and the preset normal traffic feature baseline set, it is determined whether the hybrid network has abnormal traffic patterns during the historical time period. Among them, the normal traffic feature baseline set is constructed by statistically analyzing the traffic feature sets of a large number of historical normal Pcap files, which represents the typical behavior and distribution of network traffic under normal conditions. Therefore, this application compares each traffic feature in the traffic feature set of the historical Pcap file with the normal traffic feature baseline set item by item to determine whether the hybrid network has abnormal traffic during the historical time period.

[0116] When there is no abnormal traffic pattern in the hybrid network during the historical time period, that is, the traffic of the hybrid network during the historical time period completely conforms to the preset normal behavior pattern, the abnormal traffic risk score of the hybrid network during the historical time period can be recorded as the lowest score.

[0117] When an abnormal traffic pattern exists in a hybrid network within a historical time period, at least one target attack behavior of the hybrid network within the historical time period and the risk score corresponding to each target attack behavior are determined based on the matching results of the data feature set of the historical Pcap file and the preset attack behavior feature library, and the average value of the risk scores corresponding to each target attack behavior is used as the abnormal traffic risk score of the historical Pcap file.

[0118] Among them, the attack behavior feature library stores multiple types of attack behaviors, such as denial of service attacks, distributed denial of service (DDoS) attacks, malicious scanning attacks, SQL injection attacks, worm attacks, etc., and their corresponding data feature sets and risk scores. The risk score is determined at least by the severity, frequency, and scope of impact of the attack behavior.

[0119] Step 2: Determine the neural network model. The neural network model includes at least: an abnormal traffic behavior recognition network and an attack behavior recognition network.

[0120] Step 3: Use multiple sets of training sample data to iteratively train the neural network model to obtain an abnormal traffic risk assessment model.

[0121] Therefore, the abnormal traffic risk assessment model trained by the above method can accurately identify potential attack behaviors based on the in-depth analysis of historical Pcap files, and achieve a refined assessment of abnormal traffic risk scores by quantifying the severity, frequency and impact range of various attack behaviors.

[0122] Finally, the feedback module 38 may send warning information that matches the abnormal traffic risk score to the management terminal according to the following rules:

[0123] When the abnormal traffic risk score is higher than the preset risk score threshold, the warning level can be determined to be "high". At this time, the C-IWF can send a first warning prompt message to the management terminal (i.e., the terminal device of the manager). The first warning prompt message can be designed to flash an indicator light at a first frequency and emit a buzzer at a first frequency and a first volume to attract the attention of the management terminal and convey the emergency warning information.

[0124] If the abnormal traffic risk score is not higher than the preset risk score threshold, the warning level can be determined to be "low". At this time, the C-IWF can send a second warning prompt message to the management terminal. The second warning prompt message can be designed to flash the indicator light at a second frequency and emit a buzzer at a second frequency and second volume, thereby notifying the management terminal that the network status is within the normal range and still requires attention.

[0125] The first frequency is higher than the second frequency, and the first volume is higher than the second volume.

[0126] It should be noted that the modules in the signaling intercommunication gateway in the embodiment of the present application correspond one-to-one to the implementation steps of the hybrid network security communication warning method in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1 and will not be elaborated here.

[0127] Example 3

[0128] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, the hybrid network security communication early warning method in Example 1 is implemented.

[0129] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the hybrid network security communication early warning method in Example 1 by running the computer program.

[0130] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the hybrid network security communication early warning method in Example 1 is executed when the computer program is running.

[0131] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the hybrid network security communication early warning method in Example 1 through the computer program.

[0132] Specifically, when the computer program is running, the following steps are executed: obtaining a target Pcap file of the target hybrid network within a preset time period, wherein the target Pcap file includes multiple target data packets when signaling is exchanged between core network elements in the target hybrid network; parsing each target data packet in the target Pcap file to obtain a traffic feature set and a data feature set of the target Pcap file; using an abnormal traffic risk assessment model to analyze the traffic feature set and the data feature set of the target Pcap file to obtain an abnormal traffic risk score of the target hybrid network within the preset time period, wherein the abnormal traffic risk score is used to reflect the degree of impact of the attack behavior of the target hybrid network within the preset time period on the secure communication of the target hybrid network; and sending an early warning prompt information matching the abnormal traffic risk score to the management terminal.

[0133] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 4 The following is a hardware structure diagram of an electronic device for implementing a hybrid network security communication early warning method. Figure 4 As shown, the electronic device 40 may include one or more (402a, 402b, ..., 402n are shown in the figure) processors 402 (the processor 402 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 404 for storing data, and a transmission device 406 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 4The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 4 More or fewer components than shown, or with Figure 4 Different configurations shown.

[0134] It should be noted that the one or more processors 402 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the electronic device 40. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0135] The memory 404 can be used to store software programs and modules of application software, such as the program instruction / data storage device corresponding to the hybrid network security communication early warning method in the embodiment of the present application. The processor 402 executes various functional applications and data processing by running the software programs and modules stored in the memory 404, that is, implementing the vulnerability detection method of the above-mentioned application. The memory 404 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 404 may further include a memory remotely located relative to the processor 402, and these remote memories may be connected to the electronic device 40 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0136] Transmission device 406 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of electronic device 40. In one embodiment, transmission device 406 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 406 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0137] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 40 .

[0138] The serial numbers of the above embodiments are for description only and do not represent the advantages or disadvantages of the embodiments.

[0139] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0141] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0142] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0143] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program code.

[0144] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A hybrid network security communication early warning method, characterized in that: include: Obtaining a target packet capture Pcap file of a target hybrid network within a preset time period, wherein the target Pcap file includes multiple target data packets when signaling interaction is performed between core network elements in the target hybrid network; Parsing each target data packet in the target Pcap file to obtain a flow characteristic set and a data characteristic set of the target Pcap file; Analyze the traffic feature set and data feature set of the target Pcap file using an abnormal traffic risk assessment model to obtain an abnormal traffic risk score of the target hybrid network within a preset time period, wherein the abnormal traffic risk score is used to reflect the degree of impact of attack behaviors on the target hybrid network security communication within the preset time period; Sending a warning message that matches the abnormal traffic risk score to the management terminal.

2. The method according to claim 1, characterized in that Obtain the target Pcap file of the target hybrid network within a preset time period, including: Obtaining an initial Pcap file of the target hybrid network within the preset time period, wherein the initial Pcap file includes at least: multiple data packets when the core network elements of the large network and the target private network within the target hybrid network perform signaling interaction within the preset time period, and the types of the data packets include at least one of the following: IP data packets, control plane protocol data packets related to control plane network elements, user plane protocol data packets related to user plane network elements, domain name resolution data packets, dynamic host configuration protocol data packets, and simple network management protocol data packets; Parsing each data packet in the initial Pcap file to obtain data packet content of each data packet, wherein the data packet content includes at least: data link layer information, network layer information, and transport layer information, and the data link layer information includes at least: source MAC address and destination MAC address, the network layer information includes at least: source IP address, destination IP address, and protocol type, and the transport layer information includes at least: source port and destination port; Based on the data packet content of each of the data packets, the initial Pcap file is filtered to obtain the target Pcap file, wherein the types of target data packets in the target Pcap file include: control plane protocol data packets related to the control plane network element, and user plane protocol data packets related to the user plane network element.

3. The method according to claim 2, characterized in that Based on the data packet content of each of the data packets, the initial Pcap file is filtered to obtain the target Pcap file, including: Filtering multiple data packets in the initial Pcap file according to the protocol type, and forming the target Pcap file from target data packets transmitted based on a control plane protocol or target data packets transmitted based on a user plane protocol, wherein the control plane protocol includes at least one of the following: Hypertext Transfer Protocol HTTP, Packet Forwarding Control Protocol, and the user plane protocol includes at least one of the following: General Packet Radio Service Tunneling Protocol-User Plane Protocol, Transmission Control Protocol, and User Datagram Protocol; Alternatively, multiple data packets in the initial Pcap file are filtered according to the transceiver identification information, and the target data packets whose transceiver identification information points to the control plane network element and / or user plane network element in the target hybrid network form the target Pcap file, wherein the transceiver identification information includes: source Mac address, destination Mac address, source IP address, destination IP address, source port, and destination port.

4. The method according to claim 1, wherein The traffic feature set includes at least: traffic size, traffic rate, traffic distribution, and traffic duration, wherein each data packet in the target Pcap file is parsed to obtain the traffic feature set and data feature set of the target Pcap file, including: Read each target data packet in the target Pcap file, parse the target data packet, and obtain a corresponding data packet header and data packet content, wherein the data packet header at least includes: a data packet capture timestamp, a total data packet length, and an actual captured data packet length, and the data packet content also includes: a payload content; Using the data packet content of each target data packet in the described target Pcap file as the data feature set of the described target Pcap file; The method comprises the following steps: taking the sum of the total lengths of all target data packets in the target Pcap file as the flow size of the target Pcap file; determining the timestamp difference between the capture timestamp of the first target data packet and the capture timestamp of the last target data packet in the target Pcap file, and taking the timestamp difference as the flow duration of the target Pcap file; dividing the flow size by the flow duration to obtain the average flow rate of the target Pcap file; and determining the flow proportion of different transceivers according to the transceiver identification information and the total length of the data packets of each target data packet in the target Pcap file.

5. The method according to claim 1, wherein The training process of the abnormal traffic risk assessment model includes: Acquire multiple sets of training sample data, wherein each set of the training sample data includes: traffic feature sets and data feature sets of historical Pcap files of the hybrid network in multiple historical time periods as training samples, and abnormal traffic risk scores of the hybrid network in each historical time period as sample labels of the corresponding training samples; Determine a neural network model, wherein the neural network model includes at least: an abnormal traffic behavior identification network and an attack behavior identification network; The neural network model is iteratively trained using the multiple sets of training sample data to obtain the abnormal traffic risk assessment model.

6. The method according to claim 5, characterized in that Obtain multiple sets of training sample data, including: In each historical time period, a historical Pcap file of the hybrid network in the historical time period is obtained, and each data packet in the historical Pcap file is parsed to obtain a traffic feature set and a data feature set of the historical Pcap file respectively; Determining whether the hybrid network has an abnormal traffic pattern during the historical time period based on a size relationship between the traffic feature set of the historical Pcap file and a preset normal traffic feature baseline set; When there is no abnormal traffic pattern in the hybrid network during the historical time period, the abnormal traffic risk score of the hybrid network during the historical time period is recorded as the lowest score; When an abnormal traffic pattern exists in the hybrid network within the historical time period, at least one target attack behavior of the hybrid network within the historical time period and a risk score corresponding to each target attack behavior are determined based on a matching result between the data feature set of the historical Pcap file and a preset attack behavior feature library, and an average value of the risk scores corresponding to each target attack behavior is used as the abnormal traffic risk score of the historical Pcap file, wherein the attack behavior feature library stores data feature sets and risk scores corresponding to multiple types of attack behaviors, and the risk score is determined at least by the severity, frequency, and scope of impact of the attack behavior.

7. The method according to claim 1, characterized in that Sending a warning message that matches the abnormal traffic risk score to the management terminal, including: When the abnormal traffic risk score is higher than a preset risk score threshold, a first warning prompt information is sent to the management terminal, wherein the first warning prompt information at least includes: an indicator light flashing at a first frequency, and a buzzer emitting a prompt sound at a first frequency and a first volume; When the abnormal traffic risk score is not higher than the preset risk score threshold, a second warning prompt information is sent to the management terminal, wherein the second warning prompt information at least includes: an indicator light flashing at a second frequency, and a buzzer emitting a prompt sound at a second frequency and a second volume; The first frequency is higher than the second frequency, and the first volume is higher than the second volume.

8. A signaling intercommunication gateway, characterized in that: The signaling intercommunication gateway includes at least: an acquisition module, a parsing module, a risk assessment module and an early warning module, wherein: An acquisition module is used to acquire a target Pcap file of a target hybrid network within a preset time period, wherein the target Pcap file includes multiple target data packets when signaling interaction is performed between core network elements in the target hybrid network; A parsing module is used to parse each target data packet in the target Pcap file to obtain a flow feature set and a data feature set of the target Pcap file; a risk assessment module, configured to analyze the traffic feature set and data feature set of the target Pcap file using an abnormal traffic risk assessment model to obtain an abnormal traffic risk score of the target hybrid network within a preset time period, wherein the abnormal traffic risk score is used to reflect the degree of impact of attack behaviors on the target hybrid network security communication within the preset time period; The early warning module is used to send early warning prompt information matching the abnormal traffic risk score to the management terminal.

9. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, it implements the hybrid network security communication early warning method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the hybrid network security communication early warning method according to any one of claims 1 to 7 through the computer program.

Images