Network behavior characteristic matching method and information auditing system
By adding parent-child feature tags to features and building hierarchical relationships, the problems of false positives, missed negatives, and over-reporting in logs in network behavior feature matching are solved, and efficient and accurate matching of the information audit system is achieved.
Patent Information
- Application Number
- CN202410384944.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-01
- Publication Date
- 2025-10-14
AI Technical Summary
In the existing technology, network behavior feature matching has problems such as false positives, missed positives and over-reporting of logs, which leads to low efficiency of information auditing systems.
By adding parent feature or child feature tags to features, building feature hierarchical relationships and establishing bitmap relationships, feature fields are filtered according to message content for matching, with dependent features being matched first until the session ends or the final feature match succeeds, triggering the audit policy.
It improves the accuracy and efficiency of network behavior feature matching, ensures the effective implementation of the information audit system, reduces false positives and missed negatives, and optimizes log sending.
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of information security technology, and in particular relates to a network behavior feature matching method and an information auditing system. Background Art
[0002] The rapid advancement of information technology and the development of network information system applications, while creating enormous value through high efficiency, also bring numerous security risks. These include legal risks arising from the proliferation of vulgar content, the risk of leaks from the unauthorized transmission of technical information and trade secrets, the risk of inefficiency from ineffective employee activities during working hours, and the risk of business stability from unreasonable bandwidth usage. The long-term existence of these issues can impact the normal operation of businesses or organizations and may even lead to irreparable losses.
[0003] In order to protect business systems and network information data from attacks, especially destruction, leakage, and theft from internal users, various technical means are used to monitor network behavior in the local network environment in real time, which can achieve control of network behavior, reduce various risks, and ensure network security.
[0004] One of the functions of an information audit system is to use various technical means to monitor network behavior and communication content in real time within a network environment, enabling centralized collection, recording, analysis, alerting, and processing. A key element of this system is its ability to rapidly classify and identify accessed applications and characterize browsing behavior through extensive website data analysis. When network access content successfully matches pre-defined policies and their characteristics, the corresponding audit policy actions are executed. Therefore, efficiently matching behavioral characteristics is a key technology for rapidly achieving audit objectives. Summary of the Invention
[0005] Based on the above technical background, the present invention aims to provide a network behavior feature matching method and an information auditing system.
[0006] First, a matching method for network behavior features is proposed, including: Add application and application category tags to the feature, and add parent or child tags to the feature based on whether it is an application-based feature or an application-specific function feature; Construct a hierarchical relationship between application categories, application names, and rules; Based on the feature dependencies of the preset audit policy application, a bitmap relationship from features to policies is established; Filter the content to be matched based on the message direction, protocol, length, etc., and extract the characteristic field content; The characteristic field content is matched with the bitmap relationship in sequence, and if the match is successful, the audit policy is triggered.
[0007] The feature field content is matched with the bitmap relationship in sequence; if the parent feature is successfully matched, the sub-features that the feature depends on are continued until the session to be matched ends or there is no final feature that depends on other features.
[0008] The rule includes at least one feature pointing to a specific application, and if the rule includes two or more features, the relationship must be "OR".
[0009] The characteristic fields include: IP protocol, direction, server port, application layer protocol, message length, and keywords of the message.
[0010] The features loaded will be arranged in order according to the dependency relationship to ensure that the dependent features of the feature are matched first each time.
[0011] The audit policy includes an application category and / or an application name.
[0012] A space is allocated in the memory to store all rule feature pointers, each pointer points to the actual rule feature structure.
[0013] On the other hand, an information audit system is also proposed, including a behavior feature matching module, which specifically includes: The feature preprocessing submodule divides features before matching, including adding application and application category tags to features, and adding parent or child tags to features based on whether they are application-based features or application-specific functional features; The rule base submodule builds the hierarchical relationship between application categories, application names, and rules; The feature matching module establishes a bitmap relationship from features to policies based on the feature dependency of the preset audit policy application; filters out the content to be matched based on the message direction, protocol, length, etc., and extracts the feature field content; matches the feature field content with the bitmap relationship in sequence, and triggers the audit policy if the match is successful.
[0014] The feature field content is matched with the bitmap relationship in sequence; if the parent feature is successfully matched, the sub-features that the feature depends on are continued until the session to be matched ends or there is no final feature that depends on other features.
[0015] The present invention, employing the above-described technical solution, has at least the following beneficial effects: It adds parent or child features, applications, and application category tags to the features in the feature library, constructing a hierarchical relationship between features and establishing a bitmap relationship. When acquiring data to be matched, it first parses and filters the messages to be matched, extracts the content of the feature fields, and matches them against the application category, application, and rule bitmaps configured in the preset policy from the lowest level upwards. If a match is successful, the audit policy is triggered, the preset policy actions are executed, and a log is sent. This improves matching processing efficiency, facilitates the efficient execution of audit policies, and ensures the effectiveness of information auditing. DETAILED DESCRIPTION
[0016] In order to make the purpose, technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with embodiments.
[0017] Current behavioral feature recognition mainly has the following problems: There are false positives in features, such as feature A being mistakenly reported as feature B; there are false negatives in features, such as some fields not being accurately identified, resulting in inaccurate matching; and there are multiple reports in information audit logs, such as multiple logs being sent for one match.
[0018] In practice, the applicant has found that features have dependencies and hierarchical relationships. Based on experience, the basic features of the application are used as parent features, and the specialized functional features of the application are used as child features: For example, when accessing an HTTP protocol web page, the basic feature is the GET in the HTTP message, and the specialized feature is the domain name in the HOST field. After the GET parent feature is matched in the message, the child feature is matched. If the child feature matches, a child feature log is generated. If the child feature does not match, a parent feature log is generated.
[0019] Features have categories, such as instant messaging features, video watching features, and game playing features. Dividing features into categories is conducive to extracting common basic features. For example, a sub-feature may depend on a certain feature category.
[0020] Features have application categories, such as the QQ application category, which includes features of all QQ specialized functions such as login, chat, and file transfer. Application division is conducive to extracting common basic features.
[0021] The purpose of feature division is to accelerate matching and achieve accurate matching, which reduces the workload of feature extraction.
[0022] First, an embodiment of a method for matching network behavior features is proposed, including: Add application and application category tags to the feature, and add parent or child tags to the feature based on whether it is an application-based feature or an application-specific function feature; Construct a hierarchical relationship between application categories, application names, and rules; Based on the feature dependencies of the preset audit policy application, a bitmap relationship from features to policies is established; Filter the content to be matched based on the message direction, protocol, length, etc., and extract the characteristic field content; The characteristic field content is matched with the bitmap relationship in sequence, and if the match is successful, the audit policy is triggered.
[0023] The feature field content is matched with the bitmap relationship in sequence; if the parent feature is successfully matched, the sub-features that the feature depends on are continued until the session to be matched ends or there is no final feature that depends on other features.
[0024] The rule includes at least one feature pointing to a specific application, and if the rule includes two or more features, the relationship must be "OR".
[0025] The characteristic fields include: IP protocol, direction, server port, application layer protocol, message length, and keywords of the message.
[0026] The features loaded will be arranged in order according to the dependency relationship to ensure that the dependent features of the feature are matched first each time.
[0027] The audit policy includes an application category and / or an application name.
[0028] A space is allocated in the memory to store all rule feature pointers, each pointer points to the actual rule feature structure.
[0029] On the other hand, an embodiment of an information auditing system is also proposed, including a behavior feature matching module, the behavior feature matching module specifically including: The feature preprocessing submodule divides features before matching, including adding application and application category tags to features, and adding parent or child tags to features based on whether they are application-based features or application-specific functional features; The rule base submodule builds the hierarchical relationship between application categories, application names, and rules; The feature matching module establishes a bitmap relationship from features to policies based on the feature dependency of the preset audit policy application; filters out the content to be matched based on the message direction, protocol, length, etc., and extracts the feature field content; matches the feature field content with the bitmap relationship in sequence, and triggers the audit policy if the match is successful.
[0030] The feature field content is matched with the bitmap relationship in sequence; if the parent feature is successfully matched, the sub-features that the feature depends on are continued until the session to be matched ends or there is no final feature that depends on other features.
[0031] The technical solution of the embodiment of the present invention, as described above, adds parent or child features, application and application category tags to the features in the feature library, constructing a feature hierarchy and establishing a bitmap relationship. When acquiring data to be matched, the system first parses and filters the messages to be matched, extracts the content of the feature fields, and matches them against the application category, application, and rule bitmaps configured in the policy from the lowest level upwards. If a match is successful, the audit policy is triggered, the preset policy actions are executed, and a log is sent. This improves matching processing efficiency, facilitates the efficient execution of audit policies, and ensures the effectiveness of information auditing.
[0032] Those skilled in the art will understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.
[0033] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein, but is intended to be embodied in the widest possible manner consistent with the principles disclosed herein.
Claims
1. A method for matching network behavior characteristics, characterized in that: include: Add application and application category tags to the feature, and add parent or child tags to the feature based on whether it is an application-based feature or an application-specific function feature; Construct a hierarchical relationship between application categories, application names, and rules; Based on the feature dependencies of the preset audit policy application, a bitmap relationship from features to policies is established; Filter the content to be matched based on the message direction, protocol, length, etc., and extract the characteristic field content; The characteristic field content is matched with the bitmap relationship in sequence, and if the match is successful, the audit policy is triggered.
2. The network behavior feature matching method according to claim 1, characterized in that: The feature field content is matched with the bitmap relationship in sequence; if the parent feature is successfully matched, the sub-features that the feature depends on are continued until the session to be matched ends or there is no final feature that depends on other features.
3. The network behavior feature matching method according to claim 1, characterized in that: The rule includes at least one feature pointing to a specific application, and if the rule includes two or more features, the relationship must be "OR".
4. The network behavior feature matching method according to claim 1, characterized in that: The characteristic fields include: IP protocol, direction, server port, application layer protocol, message length, and keywords of the message.
5. The network behavior feature matching method according to claim 1, characterized in that: The features loaded will be arranged in order according to the dependency relationship to ensure that the dependent features of the feature are matched first each time.
6. The network behavior feature matching method according to claim 1, characterized in that: The audit policy includes an application category and / or an application name.
7. The network behavior feature matching method according to any one of claims 1 to 6, characterized in that: A space is allocated in the memory to store all rule feature pointers, each pointer points to the actual rule feature structure.
8. An information audit system, including a behavior feature matching module, characterized in that: The behavior feature matching module specifically includes: The feature preprocessing submodule divides features before matching, including adding application and application category tags to features, and adding parent or child tags to features based on whether they are application-based features or application-specific functional features; The rule base submodule builds the hierarchical relationship between application categories, application names, and rules; The feature matching module establishes a bitmap relationship from features to policies based on the feature dependency of the preset audit policy application; filters out the content to be matched based on the message direction, protocol, length, etc., and extracts the feature field content; matches the feature field content with the bitmap relationship in sequence, and triggers the audit policy if the match is successful.
9. The information audit system according to claim 8, characterized in that: The feature field content is matched with the bitmap relationship in sequence; if the parent feature is successfully matched, the sub-features that the feature depends on are continued until the session to be matched ends or there is no final feature that depends on other features.