A data intelligent analysis system and method based on network IP tracing

Abstract

The application discloses a data intelligent analysis system and method based on network IP tracing, relates to the technical field of network tracing, and comprises the following steps: collecting network traffic data every unit period, identifying abnormal events in each unit period; identifying abnormal behavior patterns in different unit periods; extracting key information under the same behavior pattern; obtaining IP jump conditions of any abnormal event and generating an IP tracing path; judging the abnormality of each tracing path; analyzing the confidence of each key information and obtaining the comprehensive confidence of the extracted tracing path, setting a tracing confidence threshold of the tracing path; extracting key information from the real-time captured abnormal event and generating an expected tracing path; identifying the effectiveness of the expected tracing result; solving the misjudgment problem caused by static evaluation and greatly improving the reliability of the tracing result.

Description

Technical Field

[0001] This invention relates to the field of network tracing technology, specifically to an intelligent data analysis system and method based on network IP tracing. Background Technology

[0002] In today's highly interconnected network environment, network security incidents occur frequently. Quickly and accurately locating the source of attacks is crucial for improving defense capabilities. Most existing network security attribution technologies rely on static IP address information, making it difficult to effectively assess the reliability of the attribution results.

[0003] Source tracing analysis often lacks quantitative assessment of the confidence levels of different data sources and tracing steps, making it difficult to guarantee the accuracy and reliability of the tracing results. For example, source tracing based on a single network traffic characteristic is easily affected by network environment noise and attacker covert methods, leading to misjudgments. Existing methods usually lack a dynamic adjustment mechanism for confidence thresholds when assessing the confidence of source tracing results, making it unable to adapt to dynamic changes in attacker behavior, thereby reducing the efficiency and accuracy of source tracing. Summary of the Invention

[0004] The purpose of this invention is to provide a data intelligent analysis system and method based on network IP tracing to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an intelligent data analysis method based on network IP tracing, the analysis method comprising the following steps:

[0006] Step S1: Monitor network traffic data using monitoring equipment, collect network traffic data every unit period, and identify abnormal events based on the collected network traffic data for each unit period;

[0007] Step S2: Perform correlation analysis on all abnormal events in any unit period, identify abnormal behavior patterns in different unit periods; compare the event identification between different unit periods under the same behavior pattern, and extract key information under the same behavior pattern.

[0008] Step S3: Analyze the network traffic data corresponding to any abnormal event to obtain the IP redirection status of any abnormal event, and generate the IP source tracing path under any abnormal behavior pattern; compare different source tracing paths under the same behavior pattern, and make anomaly judgments for each source tracing path.

[0009] Step S4: Based on the key information contained in any anomaly tracing path, analyze the confidence level of each key information and obtain the comprehensive confidence level of the extracted tracing path; set the tracing confidence threshold of the tracing path according to the comprehensive confidence level of each anomaly tracing path.

[0010] Step S5: Extract key information from the real-time captured abnormal events, identify the real-time IP redirection situation to generate the expected tracing path; evaluate the confidence of the expected tracing path, and identify the validity of the expected tracing results.

[0011] Furthermore, step S1 includes the following steps:

[0012] Step S11: Monitor the traffic data of all nodes in real time using pre-deployed monitoring equipment. Set a unit period and collect the data transmission process between all nodes every unit period to generate a set of traffic data for the unit period and the node transmission path of each traffic data.

[0013] Step S12: A pre-constructed abnormal event database stores several abnormal events. Each abnormal event is matched with several event attributes, and each event attribute has a preset abnormal attribute threshold. A traffic data set for a given unit period is arbitrarily selected, and the corresponding attribute value is obtained according to the arbitrary event attribute. If the attribute value exceeds the preset abnormal attribute threshold, the event attribute is set as an abnormal attribute, resulting in a set of abnormal attributes for the selected unit period. The abnormal attribute set is compared with several event attributes of each abnormal event. If the abnormal attribute set contains all the event attributes of a certain abnormal event, then that abnormal event is set as an abnormal event in the selected unit period. Abnormal events include DDoS attacks, port scans, SQL injection attacks, etc. Each abnormal event is assigned corresponding event attributes, such as packet sending rate, data rate, and source IP dispersion. Some attribute values ​​cannot be directly obtained but require processing; for example, source IP dispersion requires extraction and statistical analysis of all source IPs.

[0014] Furthermore, step S2 includes the following steps:

[0015] Step S21: Randomly select a unit period, obtain all abnormal events in the selected unit period, and randomly select one abnormal event. Set the traffic data corresponding to the attribute values ​​of each event attribute in the selected abnormal event as the target traffic data. Obtain the time interval in which each target traffic data in the selected abnormal event is used as the attribute value to obtain the target, and generate the occurrence time interval of the selected abnormal event in the selected unit period. The existence of the time interval is because the target traffic data is transmitted sequentially. All data is not transmitted instantaneously at the same time. Therefore, the sequence of transmission will form a time interval.

[0016] Step S22: Obtain the occurrence time intervals of each abnormal event within the selected unit period. Randomly select two abnormal events. If the occurrence time intervals of the two abnormal events have the same time interval, obtain the length of the same time interval as T. sim Let the length of one occurrence time interval be T1 and the length of the other occurrence time interval be T2. The proportion of intervals with the same time interval is calculated as α = T. sim / Min(T1,T2), where Min() is the minimum value function, and a preset interval percentage threshold α is used. th If α≥α th Then, the target traffic data for the two abnormal events within the same time interval are obtained and compared, and the amount of the same target traffic data within the same time interval is counted as D. sim Let D1 be the target traffic data volume for one abnormal event and D2 be the target traffic data volume for another abnormal event. The calculated percentage of the same data volume is β = D. sim / Min(D1,D2), with a preset quantity percentage threshold β. th If β≥β th If two abnormal events are set as related events, then the two abnormal events are set as related events. If two abnormal events have the same time interval and the same data, it means that the two abnormal events have mutual influence in this time interval or that the two events are caused by certain data at the same time, that is, the two abnormal events are related.

[0017] Step S23: If the occurrence time intervals of the two abnormal events do not overlap, then sort the two abnormal events in chronological order. Obtain the target transmission nodes for each target traffic data in the first abnormal event, and simultaneously obtain the transmission nodes for the target traffic data in the second abnormal event. Calculate the amount of target traffic data where the target transmission node and the corresponding transmission node are the same as each other, and call this D. ’ sim Set the target traffic data in the previous abnormal event to D. ’ The calculated percentage of data from the same node is γ=D.’ sim / D ’ Preset a data percentage threshold γ th If γ≥γ th If the two abnormal events are not in the same time interval, then the order of the two abnormal events and the data transmission relationship are judged. If the data corresponding to the abnormal event is transmitted to the next node and a new abnormal time is generated in the next node, then it can be said that the two abnormal times are related.

[0018] Step S24: Summarize the abnormal events that are related to each other in the selected unit period to generate an abnormal behavior pattern for the selected unit period; obtain the abnormal behavior pattern in each unit period to get several abnormal events contained in the abnormal behavior pattern in each unit period; reselect a unit period; if there is an abnormal behavior pattern in the selected unit period, and several abnormal events in the abnormal behavior pattern are the same as the abnormal events in the selected unit period, count the number of the same abnormal events as M. sim Let M1 be the number of abnormal events selected in a unit period, and let δ = M be the proportion of the same events. sim / M1, set the quantity percentage threshold δ th If δ≥δ th Then the selected unit period and the abnormal behavior pattern of a certain unit period will be set to the same behavior pattern.

[0019] Step S25: Divide the abnormal behavior patterns existing in each unit period to generate several types of behavior patterns; arbitrarily select one type of behavior pattern, arbitrarily select two unit periods from the selected behavior patterns, compare all abnormal events in the selected two unit periods to obtain several difference events; extract the event attributes of each difference event, if the attribute value of a certain extracted event attribute is lower than the preset abnormal attribute threshold, then set the extracted event attribute as the key information of the selected behavior pattern to obtain the key information set of the selected behavior pattern.

[0020] Furthermore, step S3 includes the following steps:

[0021] Step S31: Randomly select an abnormal event, obtain the node transmission path of each target traffic data in the selected abnormal event. The node transmission path includes the source IP, the target IP, and the IP address sequence of intermediate jumps. According to the jump time of each node in the node transmission path, generate the IP jump time sequence chain of the selected abnormal event. Summarize the jump time of the target traffic data of the same data type to generate a time window, and obtain the jump time window of each node in the IP jump time sequence chain.

[0022] Step S32: Randomly select a behavior pattern and arbitrarily select a unit period from the selected behavior pattern. Obtain the IP jump time sequence chain of each abnormal event in the selected unit period. According to the jump time window at each node, align and merge the IP jump time sequence chains of each abnormal event to generate the IP jump path map of the selected behavior pattern.

[0023] Step S33: Randomly select a node from the IP jump path graph, and obtain the jump time window of the selected node in each unit cycle. If there is an overlap between the jump time windows of two unit cycles, then the selected node is taken as the common node of the two unit cycles. The number of cycles in which the selected node is taken as the common node in each unit cycle is N. T Set the number of unit cycles included in the selected behavior pattern to N. total The jump rate σ = N of the selected node is calculated. T / N total Preset a threshold σ for the percentage of redirects. th If σ≥σ th If the selected node is selected, it will be set as a valid node for the selected behavior pattern; otherwise, it will be set as an abnormal node.

[0024] Step S34: Randomly select an IP jump timing chain for one unit period from the selected behavior patterns, count the number of abnormal nodes in the IP jump timing chain as p, and set the total number of nodes in the IP jump timing chain as P. total The anomaly degree of the IP jump sequence chain is calculated as C=p / P. total A preset anomaly threshold C is defined. th If C≥C th If so, the IP jump timing chain of the selected unit period will be marked as abnormal, and the abnormal source path will be obtained by reverse tracing of the IP jump timing chain of the selected unit period.

[0025] Furthermore, step S4 includes the following steps:

[0026] Step S41: Randomly select an anomaly tracing path, acquire the anomaly events corresponding to the selected path, and obtain the set of key information in the anomaly events; randomly select one key piece of information from the set of key information, and count the number of occurrences of the selected key piece of information in each anomaly event of the corresponding behavior pattern, let h be the number of occurrences, and set the total number of anomaly events to N1. T The confidence level of the selected key information in the given behavioral pattern was calculated as Z = 1 - h / N1. T ;

[0027] Step S42: Obtain all event attributes in the abnormal event where the selected abnormal tracing path is located, and set the confidence level of the i-th event attribute as X. i If the i-th event attribute is key information among the remaining actual abnormal events, then X i =Z i Among them, Z i Let X be the confidence level of the i-th event attribute as key information. If the i-th event attribute has never been used as key information, then the confidence level X is... i =1; According to the formula:

[0028] ;

[0029] Where r is the number of event attributes of the anomaly event; the overall confidence level Z for selecting the anomaly tracing path is calculated. com The overall confidence score of all anomaly tracing paths is obtained, and the overall confidence score with the highest value is selected as the tracing confidence threshold Z for the tracing path. th .

[0030] Furthermore, step S5 includes the following steps:

[0031] Step S51: Whenever a real-time abnormal event is captured, the IP jump sequence chain corresponding to the real-time abnormal event is obtained, and the expected tracing path of the real-time abnormal event is generated.

[0032] Step S52: Obtain the confidence level of each key piece of information in the real-time abnormal event, and calculate the real-time confidence level Z of the real-time abnormal event. now ; Obtain the source tracing confidence threshold Z th If Z now <Z th If not, an invalid reminder will be sent to the tracing process.

[0033] To better implement the above methods, a data intelligent analysis system is also proposed. The analysis system includes an abnormal event capture module, an event behavior analysis module, a source tracing path analysis module, a source tracing confidence analysis module, and an abnormal tracing and identification module.

[0034] The abnormal event capture module is used to monitor network traffic data through monitoring equipment, collect network traffic data at each unit cycle, and identify abnormal events based on the collected network traffic data for each unit cycle.

[0035] The event behavior analysis module is used to perform correlation analysis on all abnormal events in any unit period, identify abnormal behavior patterns in different unit periods, compare the event identification results between different unit periods under the same behavior pattern, and extract key information under the same behavior pattern.

[0036] The source path analysis module is used to analyze network traffic data corresponding to any abnormal event, obtain the IP redirection status of any abnormal event, and generate IP source paths under any abnormal behavior pattern; it compares different source paths under the same behavior pattern and makes anomaly judgments on each source path.

[0037] The source tracing confidence analysis module is used to analyze the confidence level of each key information based on the key information contained in any abnormal source tracing path, and obtain the comprehensive confidence level of the extracted source tracing path; and to set the source tracing confidence threshold of the source tracing path according to the comprehensive confidence level of each abnormal source tracing path.

[0038] The anomaly tracing and identification module is used to extract key information from real-time captured anomaly events, identify real-time IP redirection situations to generate expected tracing paths, evaluate the confidence level of expected tracing paths, and identify the validity of expected tracing results.

[0039] Furthermore, the event behavior analysis module includes a behavior pattern recognition unit and a key information extraction unit;

[0040] The behavior pattern recognition unit is used to perform correlation analysis on all abnormal events in any unit period and to identify abnormal behavior patterns in different unit periods; the key information extraction unit is used to compare the event recognition between different unit periods under the same behavior pattern and to extract key information under the same behavior pattern.

[0041] Furthermore, the source tracing path analysis module includes a source tracing path generation unit and an effective path judgment unit;

[0042] The source tracing path generation unit is used to analyze network traffic data corresponding to any abnormal event, obtain the IP redirection status of any abnormal event, and generate IP source tracing paths under any abnormal behavior pattern; the valid path judgment unit is used to compare different source tracing paths under the same behavior pattern and judge the abnormality of each source tracing path.

[0043] Furthermore, the source tracing confidence analysis module includes a source tracing confidence calculation unit and a confidence threshold setting unit;

[0044] The source tracing confidence calculation unit is used to analyze the confidence level of each key information based on the key information content in any abnormal source tracing path, and obtain the comprehensive confidence level of the extracted source tracing path; the confidence threshold setting unit is used to set the source tracing confidence threshold of the source tracing path according to the comprehensive confidence level of each abnormal source tracing path.

[0045] Compared with the prior art, the beneficial effects of the present invention are:

[0046] 1. This invention achieves dynamic credibility assessment through a multi-dimensional confidence fusion mechanism, quantifying the reliability of key information based on its frequency of occurrence in historical anomalies; it solves the problem of misjudgment caused by static assessment, and the confidence threshold is adaptively adjusted according to the attack mode, greatly improving the reliability of the tracing results;

[0047] 2. This invention uses multi-cycle behavior pattern recognition and key information extraction technology to dynamically screen high-confidence nodes and remove abnormal jump points. At the same time, based on the comprehensive confidence assessment mechanism of key information, it avoids relying on a single static feature and can effectively resist covert means such as IP spoofing and proxy jumps, providing accurate basis for security response.

[0048] 3. This invention accurately identifies cross-cycle attack chains through a spatiotemporal dual-dimensional event correlation algorithm and multi-cycle behavior pattern comparison. For example, it constructs behavior pattern profiles based on time overlap rate, data similarity, and node propagation correlation, breaking through the limitations of traditional single-event analysis. This significantly improves the applicability and accuracy of tracing conclusions in dynamic network environments. Attached Figure Description

[0049] Figure 1 This is a schematic diagram illustrating the steps of a data intelligent analysis method based on network IP tracing;

[0050] Figure 2 This is a schematic diagram of the structure of a data intelligent analysis system based on network IP tracing. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] Example: Figures 1 to 2 As shown, this invention provides an intelligent data analysis method based on network IP tracing. The analysis method includes the following steps:

[0053] Step S1: Monitor network traffic data using monitoring equipment, collect network traffic data every unit period, and identify abnormal events based on the collected network traffic data for each unit period;

[0054] Step S1 includes the following steps:

[0055] Step S11: Monitor the traffic data of all nodes in real time using pre-deployed monitoring equipment. Set a unit period and collect the data transmission process between all nodes every unit period to generate a set of traffic data for the unit period and the node transmission path of each traffic data.

[0056] Step S12: Pre-construct an abnormal event database, which stores several abnormal events. Each abnormal event is matched with several event attributes, and each event attribute has a preset abnormal attribute threshold. Arbitrarily select a traffic data set for a unit period, and obtain the corresponding attribute value according to the arbitrary event attribute. If the attribute value exceeds the preset abnormal attribute threshold, the event attribute is set as an abnormal attribute, thus obtaining the abnormal attribute set for the selected unit period. Compare the abnormal attribute set with several event attributes of each abnormal event. If the abnormal attribute set contains all the event attributes of a certain abnormal event, then that abnormal event is set as an abnormal event in the selected unit period.

[0057] Example 1: A "DDoS attack" event is predefined in the abnormal event database. Its event attributes include a packet rate threshold of 10,000 packets / second and an abnormal connection number threshold of 500. If a periodic dataset detects a rate of 12,000 packets / second and an abnormal connection number of 600, it is determined to be a DDoS abnormal event.

[0058] Step S2: Perform correlation analysis on all abnormal events in any unit period, identify abnormal behavior patterns in different unit periods; compare the event identification between different unit periods under the same behavior pattern, and extract key information under the same behavior pattern.

[0059] Step S2 includes the following steps:

[0060] Step S21: Randomly select a unit period, obtain all abnormal events in the selected unit period, and randomly select one abnormal event. Set the traffic data corresponding to the attribute values ​​of each event attribute in the selected abnormal event as the target traffic data. Obtain the time interval where the target traffic data in the selected abnormal event is obtained as the attribute value, and generate the occurrence time interval of the selected abnormal event in the selected unit period.

[0061] Step S22: Obtain the occurrence time intervals of each abnormal event within the selected unit period. Randomly select two abnormal events. If the occurrence time intervals of the two abnormal events have the same time interval, obtain the length of the same time interval as T. simLet the length of one occurrence time interval be T1 and the length of the other occurrence time interval be T2. The proportion of intervals with the same time interval is calculated as α = T. sim / Min(T1,T2), where Min() is the minimum value function, and a preset interval percentage threshold α is used. th If α≥α th Then, the target traffic data for the two abnormal events within the same time interval are obtained and compared, and the amount of the same target traffic data within the same time interval is counted as D. sim Let D1 be the target traffic data volume for one abnormal event and D2 be the target traffic data volume for another abnormal event. The calculated percentage of the same data volume is β = D. sim / Min(D1,D2), with a preset quantity percentage threshold β. th If β≥β th Then, the two abnormal events will be set as related events;

[0062] Step S23: If the occurrence time intervals of the two abnormal events do not overlap, then sort the two abnormal events in chronological order. Obtain the target transmission nodes for each target traffic data in the first abnormal event, and simultaneously obtain the transmission nodes for the target traffic data in the second abnormal event. Calculate the amount of target traffic data where the target transmission node and the corresponding transmission node are the same as each other, and call this D. ’ sim Set the target traffic data in the previous abnormal event to D. ’ The calculated percentage of data from the same node is γ=D. ’ sim / D ’ Preset a data percentage threshold γ th If γ≥γ th Similarly, the two abnormal events will be set as related events.

[0063] Example 2: In period A, the time interval for event E1 is set to [09:00-09:05] and the time interval for event E2 is set to [09:03-09:08]. The time overlap ratio α is calculated to be 3 / 5 = 0.6. The amount of identical traffic data within the overlapping time period is set to 450, and the target traffic data amount for event E1 is 500 and the target traffic data amount for event E2 is 600, resulting in an identical data volume ratio β = 450 / 500 = 0.9. A quantity ratio threshold β is set. th =0.8, therefore the two abnormal events are related events;

[0064] Step S24: Summarize the abnormal events that are related to each other in the selected unit period to generate an abnormal behavior pattern for the selected unit period; obtain the abnormal behavior pattern in each unit period to get several abnormal events contained in the abnormal behavior pattern in each unit period; reselect a unit period; if there is an abnormal behavior pattern in the selected unit period, and several abnormal events in the abnormal behavior pattern are the same as the abnormal events in the selected unit period, count the number of the same abnormal events as M. sim Let M1 be the number of abnormal events selected in a unit period, and let δ = M be the proportion of the same events. sim / M1, set the quantity percentage threshold δ th If δ≥δ th Then the selected unit period and the abnormal behavior pattern of a certain unit period will be set to the same behavior pattern.

[0065] Step S25: Divide the abnormal behavior patterns existing in each unit period to generate several types of behavior patterns; arbitrarily select one type of behavior pattern, arbitrarily select two unit periods from the selected behavior patterns, compare all abnormal events in the selected two unit periods to obtain several difference events; extract the event attributes of each difference event, if the attribute value of a certain extracted event attribute is lower than the preset abnormal attribute threshold, then set the extracted event attribute as the key information of the selected behavior pattern to obtain the key information set of the selected behavior pattern.

[0066] Step S3: Analyze the network traffic data corresponding to any abnormal event to obtain the IP redirection status of any abnormal event, and generate the IP source tracing path under any abnormal behavior pattern; compare different source tracing paths under the same behavior pattern, and make anomaly judgments for each source tracing path.

[0067] Step S3 includes the following steps:

[0068] Step S31: Randomly select an abnormal event, obtain the node transmission path of each target traffic data in the selected abnormal event. The node transmission path includes the source IP, the target IP, and the IP address sequence of intermediate jumps. According to the jump time of each node in the node transmission path, generate the IP jump time sequence chain of the selected abnormal event. Summarize the jump time of the target traffic data of the same data type to generate a time window, and obtain the jump time window of each node in the IP jump time sequence chain.

[0069] Step S32: Randomly select a behavior pattern and arbitrarily select a unit period from the selected behavior pattern. Obtain the IP jump time sequence chain of each abnormal event in the selected unit period. According to the jump time window at each node, align and merge the IP jump time sequence chains of each abnormal event to generate the IP jump path map of the selected behavior pattern.

[0070] Step S33: Randomly select a node from the IP jump path graph, and obtain the jump time window of the selected node in each unit cycle. If there is an overlap between the jump time windows of two unit cycles, then the selected node is taken as the common node of the two unit cycles. The number of cycles in which the selected node is taken as the common node in each unit cycle is N. T Set the number of unit cycles included in the selected behavior pattern to N. total The jump rate σ = N of the selected node is calculated. T / N total Preset a threshold σ for the percentage of redirects. th If σ≥σ th If the selected node is selected, it will be set as a valid node for the selected behavior pattern; otherwise, it will be set as an abnormal node.

[0071] Step S34: Randomly select an IP jump timing chain for one unit period from the selected behavior patterns, count the number of abnormal nodes in the IP jump timing chain as p, and set the total number of nodes in the IP jump timing chain as P. total The anomaly degree of the IP jump sequence chain is calculated as C=p / P. total A preset anomaly threshold C is defined. th If C≥C th If so, the IP jump timing chain of the selected unit period will be marked as abnormal, and the abnormal source path will be obtained by reverse tracing of the IP jump timing chain of the selected unit period.

[0072] Step S4: Based on the key information contained in any anomaly tracing path, analyze the confidence level of each key information and obtain the comprehensive confidence level of the extracted tracing path; set the tracing confidence threshold of the tracing path according to the comprehensive confidence level of each anomaly tracing path.

[0073] Step S4 includes the following steps:

[0074] Step S41: Randomly select an anomaly tracing path, acquire the anomaly events corresponding to the selected path, and obtain the set of key information in the anomaly events; randomly select one key piece of information from the set of key information, and count the number of occurrences of the selected key piece of information in each anomaly event of the corresponding behavior pattern, let h be the number of occurrences, and set the total number of anomaly events to N1. TThe confidence level of the selected key information in the given behavioral pattern was calculated as Z = 1 - h / N1. T ;

[0075] Step S42: Obtain all event attributes in the abnormal event where the selected abnormal tracing path is located, and set the confidence level of the i-th event attribute as X. i If the i-th event attribute is key information among the remaining actual abnormal events, then X i =Z i Among them, Z i Let X be the confidence level of the i-th event attribute as key information. If the i-th event attribute has never been used as key information, then the confidence level X is... i =1; According to the formula:

[0076] ;

[0077] Where r is the number of event attributes of the anomaly event; the overall confidence level Z for selecting the anomaly tracing path is calculated. com The overall confidence score of all anomaly tracing paths is obtained, and the overall confidence score with the highest value is selected as the tracing confidence threshold Z for the tracing path. th ;

[0078] Example 3: The key information "ICMP packet ratio" is set to appear 3 times in 10 abnormal events, resulting in a confidence level Z = 1 - 3 / 10 = 0.7. Three event attributes are selected in the anomaly tracing path, with confidence levels of 0.7, 1, and 0.8 respectively. The overall confidence level Z is calculated. com =(0.7+0.8+1) / 3=0.83; The maximum overall confidence level of all tracing paths, 0.9, is set as the tracing confidence threshold, i.e., Z. th =0.9.

[0079] Step S5: Extract key information from the real-time captured abnormal events, identify the real-time IP redirection situation to generate the expected tracing path; evaluate the confidence of the expected tracing path, and identify the validity of the expected tracing results;

[0080] Step S5 includes the following steps:

[0081] Step S51: Whenever a real-time abnormal event is captured, the IP jump sequence chain corresponding to the real-time abnormal event is obtained, and the expected tracing path of the real-time abnormal event is generated.

[0082] Step S52: Obtain the confidence level of each key piece of information in the real-time abnormal event, and calculate the real-time confidence level Z of the real-time abnormal event. now ; Obtain the source tracing confidence threshold Z th If Znow <Z th If not, an invalid reminder will be sent to the tracing process.

[0083] A data intelligent analysis system includes an abnormal event capture module, an event behavior analysis module, a source tracing path analysis module, a source tracing confidence analysis module, and an abnormal tracing and identification module.

[0084] The abnormal event capture module is used to monitor network traffic data through monitoring equipment, collect network traffic data at each unit cycle, and identify abnormal events based on the collected network traffic data for each unit cycle.

[0085] The event behavior analysis module is used to perform correlation analysis on all abnormal events in any unit period, identify abnormal behavior patterns in different unit periods, compare the event identification results between different unit periods under the same behavior pattern, and extract key information under the same behavior pattern.

[0086] The source path analysis module is used to analyze network traffic data corresponding to any abnormal event, obtain the IP redirection status of any abnormal event, and generate IP source paths under any abnormal behavior pattern; it compares different source paths under the same behavior pattern and makes anomaly judgments on each source path.

[0087] The source tracing confidence analysis module is used to analyze the confidence level of each key information based on the key information contained in any abnormal source tracing path, and obtain the comprehensive confidence level of the extracted source tracing path; and to set the source tracing confidence threshold of the source tracing path according to the comprehensive confidence level of each abnormal source tracing path.

[0088] The anomaly tracing and identification module is used to extract key information from real-time captured anomaly events, identify real-time IP redirection situations to generate expected tracing paths, evaluate the confidence level of expected tracing paths, and identify the validity of expected tracing results.

[0089] The event behavior analysis module includes a behavior pattern recognition unit and a key information extraction unit.

[0090] The behavior pattern recognition unit is used to perform correlation analysis on all abnormal events in any unit period and to identify abnormal behavior patterns in different unit periods; the key information extraction unit is used to compare the event recognition between different unit periods under the same behavior pattern and to extract key information under the same behavior pattern.

[0091] The source tracing path analysis module includes a source tracing path generation unit and an effective path judgment unit;

[0092] The source tracing path generation unit is used to analyze network traffic data corresponding to any abnormal event, obtain the IP redirection status of any abnormal event, and generate IP source tracing paths under any abnormal behavior pattern; the valid path judgment unit is used to compare different source tracing paths under the same behavior pattern and judge the abnormality of each source tracing path.

[0093] The source tracing confidence analysis module includes a source tracing confidence calculation unit and a confidence threshold setting unit;

[0094] The source tracing confidence calculation unit is used to analyze the confidence level of each key information based on the key information content in any abnormal source tracing path, and obtain the comprehensive confidence level of the extracted source tracing path; the confidence threshold setting unit is used to set the source tracing confidence threshold of the source tracing path according to the comprehensive confidence level of each abnormal source tracing path.

[0095] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A data intelligent analysis method based on network IP tracing, characterized in that: The analytical method includes the following steps: Step S1: Monitor network traffic data using monitoring equipment, collect network traffic data every unit period, and identify abnormal events based on the collected network traffic data for each unit period; Step S2: Perform correlation analysis on all abnormal events in any unit period, identify abnormal behavior patterns in different unit periods; compare the event identification between different unit periods under the same behavior pattern, and extract key information under the same behavior pattern. Step S3: Analyze the network traffic data corresponding to any abnormal event to obtain the IP redirection status of any abnormal event, and generate the IP source tracing path under any abnormal behavior pattern; compare different source tracing paths under the same behavior pattern, and make anomaly judgments for each source tracing path. Step S4: Based on the key information contained in any anomaly tracing path, analyze the confidence level of each key information and obtain the comprehensive confidence level of the extracted tracing path; set the tracing confidence threshold of the tracing path according to the comprehensive confidence level of each anomaly tracing path. Step S5: Extract key information from the real-time captured abnormal events, identify the real-time IP redirection situation to generate the expected tracing path; evaluate the confidence of the expected tracing path, and identify the validity of the expected tracing results; Step S4 includes the following steps: Step S41: Randomly select an anomaly tracing path, acquire the anomaly events corresponding to the selected path, and obtain the set of key information in the anomaly events; randomly select one key piece of information from the set of key information, and count the number of occurrences of the selected key piece of information in each anomaly event of the corresponding behavior pattern, let h be the number of occurrences, and set the total number of anomaly events to N1. T The confidence level of the selected key information in the given behavioral pattern was calculated as Z = 1 - h / N1. T ; Step S42: Obtain all event attributes in the abnormal event where the selected abnormal tracing path is located, and set the confidence level of the i-th event attribute as X. i If the i-th event attribute is key information among the remaining actual abnormal events, then X i =Z i Among them, Z i Let X be the confidence level of the i-th event attribute as key information. If the i-th event attribute has never been used as key information, then the confidence level X is... i =1; According to the formula: ； Where r is the number of event attributes in the anomaly event; the overall confidence level Z for selecting the anomaly tracing path is calculated. com The overall confidence score of all anomaly tracing paths is obtained, and the overall confidence score with the highest value is selected as the tracing confidence threshold Z for the tracing path. th ; Step S5 includes the following steps: Step S51: Whenever a real-time abnormal event is captured, the IP jump sequence chain corresponding to the real-time abnormal event is obtained, and the expected tracing path of the real-time abnormal event is generated. Step S52: Obtain the confidence level of each key piece of information in the real-time abnormal event, and calculate the real-time confidence level Z of the real-time abnormal event. now ; Obtain the source tracing confidence threshold Z th If Z now <Z th If not, an invalid reminder will be sent to the tracing process.

2. The intelligent data analysis method based on network IP tracing according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Monitor the traffic data of all nodes in real time using pre-deployed monitoring equipment. Set a unit period and collect the data transmission process between all nodes every unit period to generate a set of traffic data for the unit period and the node transmission path of each traffic data. Step S12: Pre-construct an abnormal event database, which stores several abnormal events. Each abnormal event is matched with several event attributes, and each event attribute has a preset abnormal attribute threshold. Arbitrarily select a set of traffic data for a unit period, and obtain the corresponding attribute value according to the arbitrary event attribute. If the attribute value exceeds the preset abnormal attribute threshold, the event attribute is set as an abnormal attribute, thus obtaining a set of abnormal attributes for the selected unit period. Compare the set of abnormal attributes with several event attributes of each abnormal event. If the set of abnormal attributes contains all the event attributes of a certain abnormal event, then that abnormal event is set as an abnormal event in the selected unit period.

3. The intelligent data analysis method based on network IP tracing according to claim 2, characterized in that: Step S2 includes the following steps: Step S21: Randomly select a unit period, obtain all abnormal events in the selected unit period, and randomly select one abnormal event. Set the traffic data corresponding to the attribute values ​​of each event attribute in the selected abnormal event as the target traffic data. Obtain the time interval where the target traffic data in the selected abnormal event is obtained as the attribute value, and generate the occurrence time interval of the selected abnormal event in the selected unit period. Step S22: Obtain the occurrence time intervals of each abnormal event within the selected unit period. Randomly select two abnormal events. If the occurrence time intervals of the two abnormal events have the same time interval, obtain the length of the same time interval as T. sim Let the length of one occurrence time interval be T1 and the length of the other occurrence time interval be T2. The proportion of intervals with the same time interval is calculated as α = T. sim / Min(T1,T2), where Min() is the minimum value function, and a preset interval percentage threshold α is used. th If α≥α th Then, the target traffic data for the two abnormal events within the same time interval are obtained and compared, and the amount of the same target traffic data within the same time interval is counted as D. sim Let D1 be the target traffic data volume for one abnormal event and D2 be the target traffic data volume for another abnormal event. The calculated percentage of the same data volume is β = D. sim / Min(D1,D2), with a preset quantity percentage threshold β. th If β≥β th Then, the two abnormal events will be set as related events; Step S23: If the occurrence time intervals of the two abnormal events do not overlap, then sort the two abnormal events in chronological order. Obtain the target transmission nodes for each target traffic data in the first abnormal event, and simultaneously obtain the transmission nodes for the target traffic data in the second abnormal event. Calculate the amount of target traffic data where the target transmission node and the corresponding transmission node are the same as each other, and call this D. ’ sim Set the target traffic data in the previous abnormal event to D. ’ The calculated percentage of data from the same node is γ=D. ’ sim / D ’ Preset a data percentage threshold γ th If γ≥γ th Similarly, the two abnormal events will be set as related events. Step S24: Summarize the abnormal events that are related to each other in the selected unit period to generate an abnormal behavior pattern for the selected unit period; obtain the abnormal behavior pattern in each unit period to get several abnormal events contained in the abnormal behavior pattern in each unit period; reselect a unit period; if there is an abnormal behavior pattern in the selected unit period, and several abnormal events in the abnormal behavior pattern are the same as the abnormal events in the selected unit period, count the number of the same abnormal events as M. sim Let M1 be the number of abnormal events selected in a unit period, and let δ = M be the proportion of the same events. sim / M1, set the quantity percentage threshold δ th If δ≥δ th Then the selected unit period and the abnormal behavior pattern of a certain unit period will be set to the same behavior pattern. Step S25: Divide the abnormal behavior patterns existing in each unit period to generate several types of behavior patterns; arbitrarily select one type of behavior pattern, arbitrarily select two unit periods from the selected behavior patterns, compare all abnormal events in the selected two unit periods to obtain several difference events; extract the event attributes of each difference event, if the attribute value of a certain extracted event attribute is lower than the preset abnormal attribute threshold, then set the extracted event attribute as the key information of the selected behavior pattern to obtain the key information set of the selected behavior pattern.

4. The intelligent data analysis method based on network IP tracing according to claim 3, characterized in that: Step S3 includes the following steps: Step S31: Randomly select an abnormal event, obtain the node transmission path of each target traffic data in the selected abnormal event. The node transmission path includes the source IP, the target IP, and the IP address sequence of intermediate jumps. According to the jump time of each node in the node transmission path, generate the IP jump time sequence chain of the selected abnormal event. Summarize the jump time of the target traffic data of the same data type to generate a time window, and obtain the jump time window of each node in the IP jump time sequence chain. Step S32: Randomly select a behavior pattern and arbitrarily select a unit period from the selected behavior pattern. Obtain the IP jump time sequence chain of each abnormal event in the selected unit period. According to the jump time window at each node, align and merge the IP jump time sequence chains of each abnormal event to generate the IP jump path map of the selected behavior pattern. Step S33: Randomly select a node from the IP jump path graph, and obtain the jump time window of the selected node in each unit cycle. If there is an overlap between the jump time windows of two unit cycles, then the selected node is taken as the common node of the two unit cycles. The number of cycles in which the selected node is taken as the common node in each unit cycle is N. T Set the number of unit cycles included in the selected behavior pattern to N. total The jump rate σ = N of the selected node is calculated. T / N total Preset a threshold σ for the percentage of redirects. th If σ≥σ th If the selected node is valid, it will be set as a valid node for the selected behavior pattern; otherwise, it will be set as an abnormal node. Step S34: Randomly select an IP jump timing chain for one unit period from the selected behavior patterns, count the number of abnormal nodes in the IP jump timing chain as p, and set the total number of nodes in the IP jump timing chain as P. total The anomaly degree of the IP jump sequence chain is calculated as C=p / P. total A preset anomaly threshold C is defined. th If C≥C th If so, the IP jump timing chain of the selected unit period will be marked as abnormal, and the abnormal source path will be obtained by reverse tracing of the IP jump timing chain of the selected unit period.

5. A data intelligent analysis system, used to execute the data intelligent analysis method based on network IP tracing as described in any one of claims 1-4, characterized in that: The analysis system includes an abnormal event capture module, an event behavior analysis module, a source tracing path analysis module, a source tracing confidence analysis module, and an abnormal tracing and identification module. The abnormal event capture module is used to monitor network traffic data through monitoring equipment, collect network traffic data every unit period, and identify abnormal events in each unit period based on the collected network traffic data. The event behavior analysis module is used to perform correlation analysis on all abnormal events in any unit period, identify abnormal behavior patterns in different unit periods, compare the event identification results between different unit periods under the same behavior pattern, and extract key information under the same behavior pattern. The source tracing path analysis module is used to analyze the network traffic data corresponding to any abnormal event, obtain the IP redirection status of any abnormal event, and generate the IP source tracing path under any abnormal behavior mode. Compare different tracing paths under the same behavior pattern, and make anomaly judgments for each tracing path; The source tracing confidence analysis module is used to analyze the confidence of each key information based on the key information contained in any abnormal source tracing path, and obtain the comprehensive confidence of the extracted source tracing path. Based on the overall confidence level of each anomaly tracing path, a tracing confidence threshold is set for the tracing path; The anomaly tracing and identification module is used to extract key information from real-time captured anomaly events, identify real-time IP redirection situations to generate expected tracing paths, evaluate the confidence level of expected tracing paths, and identify the validity of expected tracing results.

6. The data intelligent analysis system according to claim 5, characterized in that: The event behavior analysis module includes a behavior pattern recognition unit and a key information extraction unit; The behavior pattern recognition unit is used to perform correlation analysis on all abnormal events in any unit period and to identify abnormal behavior patterns in different unit periods. The key information extraction unit is used to compare the event identification results between different unit cycles under the same behavior pattern and extract key information under the same behavior pattern.

7. The data intelligent analysis system according to claim 5, characterized in that: The source tracing path analysis module includes a source tracing path generation unit and a valid path judgment unit; The source tracing path generation unit is used to analyze the network traffic data corresponding to any abnormal event, obtain the IP redirection status of any abnormal event, and generate the IP source tracing path under any abnormal behavior mode. The effective path judgment unit is used to compare different tracing paths under the same behavior pattern and to judge the anomalies of each tracing path.

8. The data intelligent analysis system according to claim 5, characterized in that: The source tracing confidence analysis module includes a source tracing confidence calculation unit and a confidence threshold setting unit; The source tracing confidence calculation unit is used to analyze the confidence level of each key information based on the key information content in any abnormal source tracing path, and obtain the comprehensive confidence level of the extracted source tracing path; the confidence threshold setting unit is used to set the source tracing confidence threshold of the source tracing path according to the comprehensive confidence level of each abnormal source tracing path.

Images