A method and apparatus for monitoring information protection of a computer network

Abstract

The application discloses a kind of information protection monitoring method and device of computer network, the method includes: obtaining the topological structure information and standard traffic information set of computer network;The topological structure information includes the connection relationship between each node of computer network;The standard traffic information set includes the traffic standard value between each two nodes of the interconnection of computer network, traffic upper limit value and traffic lower limit value;Based on the topological structure information, the traffic monitoring of the computer network is carried out, and network real-time traffic information set is obtained;Based on standard traffic information set, the network real-time traffic information set is carried out protection monitoring processing, and monitoring result information is obtained.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and information systems, in particular to a computer network information protection monitoring method and device. BACKGROUND

[0002] The current computer network information protection monitoring field faces the following technical challenges:

[0003] Insufficient precision of traffic anomaly detection: Traditional monitoring methods are mostly based on a single threshold or a simple statistical model (such as mean ± standard deviation), which is difficult to capture hidden attacks in complex network environments (such as low-rate DoS attacks and slow scanning penetration). The traffic characteristics of these attacks may not significantly exceed the threshold, but long-term accumulation can lead to security risks.

[0004] Global and local features are fragmented: Existing technologies often analyze node traffic or link traffic separately, lacking joint modeling of network topology structure and traffic dynamics. For example, when the traffic of a certain link is normal but the upstream and downstream node traffic associated with it is abnormal, traditional methods are difficult to identify potential traffic transfer attacks.

[0005] Real-time and computational efficiency contradiction: Network traffic monitoring needs to process massive high-frequency data, while complex models (such as deep learning) have high computational overhead, resulting in decreased real-time response capability. Traditional autoregressive models are computationally efficient, but cannot dynamically adapt to network topology changes.

[0006] Weak generalization ability of abnormal patterns: Fixed rules or pre-trained models are difficult to cope with new attack patterns (such as AI-based adaptive traffic attacks), and lack active discovery mechanisms for unknown anomalies. SUMMARY

[0007] The present application mainly solves the problems of low detection precision, poor real-time performance and weak generalization ability of abnormal patterns in current computer network information security monitoring. The present application discloses a computer network information protection monitoring method and device.

[0008] In a first aspect, the present application discloses a computer network information protection monitoring method, comprising:

[0009] S1, obtaining topology structure information and a set of standard traffic information of a computer network; the topology structure information includes the connection relationship between each node of the computer network; the set of standard traffic information includes the traffic standard value, the upper limit value and the lower limit value of the communication link between each two nodes of the computer network connected to each other;

[0010] S2, based on the topology structure information, performing traffic monitoring on the computer network to obtain a set of network real-time traffic information;

[0011] S3, based on the standard traffic information set, perform protection monitoring processing on the real-time network traffic information set to obtain monitoring result information.

[0012] The step of monitoring the computer network based on the topology information to obtain a set of real-time network traffic information includes:

[0013] S21, based on the topology information, monitor the communication links between every two interconnected nodes of the computer network to obtain a traffic information sequence of the communication links within a preset time interval; the traffic information sequence is a sequence of traffic information collected at several collection times within the preset time interval.

[0014] S22, representing the sequence of traffic information of all communication links as a three-dimensional matrix of traffic information;

[0015] S23, Perform traffic typical value modeling and calculation on the traffic information sequence of each communication link to obtain the traffic typical value of the communication link;

[0016] S24. Using the three-dimensional matrix of traffic information and the typical traffic values ​​of all communication links, a set of real-time network traffic information is constructed.

[0017] The step of performing traffic typical value modeling and calculation on the traffic information sequence of each communication link to obtain the traffic typical value of the communication link includes:

[0018] S231, perform traffic feature modeling on the traffic information sequence of all communication links to obtain the traffic feature function;

[0019] S232, Perform typical time calculation on the traffic information sequence of each communication link to obtain the typical time value of the communication link;

[0020] S233, using the traffic characteristic function, calculate the typical time value of each communication link to obtain the typical traffic value of the communication link.

[0021] The process of modeling traffic characteristics for the traffic information sequences of all communication links to obtain traffic characteristic functions includes:

[0022] S2311, For each communication link's traffic information sequence, with the acquisition time as the independent variable and the traffic information as the dependent variable, perform autoregressive-moving average modeling on the independent and dependent variables to obtain the corresponding regression models.

[0023] S2312, extract the coefficient vector of the regression model for all communication links;

[0024] S2313, perform cross-correlation calculation on the coefficient vectors of the regression models of all communication links to obtain a cross-correlation matrix; the elements in the i-th row and j-th column of the cross-correlation matrix are the cross-correlation values ​​of the coefficient vectors of the regression models of the i-th and j-th communication links.

[0025] S2314, Perform singular value calculation on the cross-correlation matrix to obtain a singular value sequence;

[0026] S2315, using the element values ​​of the singular value sequence as known dependent variables and the element indices of the singular value sequence as known independent variables, a curve to be approximated is constructed using the known independent and dependent variables; polynomial fitting is performed on the curve to be approximated to obtain the flow characteristic function.

[0027] The step of performing typical time calculations on the traffic information sequence of each communication link to obtain the typical time value of the communication link includes:

[0028] S2321, For the values ​​of the traffic information sequence of each communication link, perform value distribution statistics to obtain the corresponding value probability distribution function and value distribution probability; the value distribution probability is the distribution probability of the element values ​​of the traffic information sequence within each preset value interval;

[0029] S2322, perform fusion probability calculation on the probability distribution of the values ​​to obtain the feature probability value;

[0030] S2323, Based on the value probability distribution function, determine the value corresponding to the feature probability value in the value probability distribution function, which is the feature probability value;

[0031] S2324, find the collection time corresponding to the traffic information value that is closest to the feature probability value in the traffic information sequence, which is the typical time value of the communication link.

[0032] The expression for calculating the fusion probability is:

[0033]

[0034] Where DT is the feature probability value, P i Let H be the probability distribution of the i-th value interval, and H be the total number of value intervals.

[0035] The process of performing protection monitoring on the real-time network traffic information set based on the standard traffic information set to obtain monitoring result information includes:

[0036] S31, based on the standard traffic information set, performs feature monitoring processing on the typical traffic values ​​of all communication links to obtain traffic feature monitoring values;

[0037] S32, based on the standard traffic information set, performs global monitoring processing on the three-dimensional matrix of traffic information to obtain global traffic monitoring values;

[0038] S33, based on the preset traffic monitoring value range, the traffic feature monitoring value and the global traffic monitoring value are processed to obtain monitoring result information.

[0039] A second aspect of the present invention discloses an information protection and monitoring device for computer networks, the device comprising:

[0040] Memory containing executable program code;

[0041] A processor coupled to the memory;

[0042] The processor calls the executable program code stored in the memory to execute the information protection and monitoring method for the computer network.

[0043] In a third aspect of this invention, a computer-storable medium is disclosed, wherein the computer-storable medium stores computer instructions, and when the computer instructions are invoked by a computer, they are used to execute the information protection and monitoring method for the computer network.

[0044] A fourth aspect of the present invention discloses an information data processing terminal, which is used to implement the information protection and monitoring method for computer networks.

[0045] The beneficial effects of this invention are as follows:

[0046] This invention represents traffic information as a three-dimensional matrix (time, link, traffic value), combines it with the ARMA model to capture temporal features, and extracts the correlation patterns between links through singular value decomposition, forming a feature expression that combines global and local features, thereby improving the ability to characterize complex traffic patterns.

[0047] This invention dynamically determines the characteristic probability value through probability distribution fusion calculation (DT formula), and then extracts the traffic value at typical time points, avoiding the sensitivity of traditional average or peak statistics to outliers, and more accurately reflecting the essential characteristics of network traffic.

[0048] This invention simultaneously performs feature monitoring (for typical traffic values) and global monitoring (for three-dimensional matrices). The former focuses on link-level anomalies, while the latter captures the propagation of anomalies at the network topology level, achieving multi-layered protection. Operations such as polynomial fitting of traffic characteristic functions and singular value decomposition for dimensionality reduction transform complex network traffic analysis into efficient matrix operations while ensuring monitoring accuracy, meeting real-time requirements. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention. Detailed Implementation

[0050] To better understand the content of this invention, an embodiment is provided here.

[0051] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention.

[0052] In a first aspect, this invention discloses a method for information protection and monitoring of computer networks, comprising:

[0053] S1, Obtain the topology information and standard traffic information set of the computer network; the topology information includes the connection relationship between each node of the computer network; the standard traffic information set includes the standard traffic value, upper traffic limit value and lower traffic limit value of the communication link between every two interconnected nodes of the computer network.

[0054] S2, Based on the topology information, perform traffic monitoring on the computer network to obtain a set of real-time network traffic information;

[0055] S3, based on the standard traffic information set, perform protection monitoring processing on the real-time network traffic information set to obtain monitoring result information.

[0056] The step of monitoring the computer network based on the topology information to obtain a set of real-time network traffic information includes:

[0057] S21, Based on the topology information, the communication links between every two interconnected nodes of the computer network are monitored to obtain a sequence of traffic information of the communication links within a preset time interval; the sequence of traffic information is a sequence of traffic information collected at several collection times within the preset time interval.

[0058] S22, representing the sequence of traffic information of all communication links as a three-dimensional matrix of traffic information;

[0059] S23, Perform traffic typical value modeling and calculation on the traffic information sequence of each communication link to obtain the traffic typical value of the communication link;

[0060] S24. Using the three-dimensional matrix of traffic information and the typical traffic values ​​of all communication links, a set of real-time network traffic information is constructed.

[0061] The elements of the three-dimensional matrix of traffic information, with dimensions [i,j,k], represent the traffic information of the communication link between the j-th node and the k-th node at the i-th acquisition time; traffic information refers to the magnitude of network traffic.

[0062] The monitoring of the communication links between every two interconnected nodes in the computer network to obtain the traffic information sequence of the communication links within a preset time interval can be achieved using appropriate network traffic monitoring tools.

[0063] The step of performing traffic typical value modeling and calculation on the traffic information sequence of each communication link to obtain the traffic typical value of the communication link includes:

[0064] S231, perform traffic feature modeling on the traffic information sequence of all communication links to obtain the traffic feature function;

[0065] S232, Perform typical time calculation on the traffic information sequence of each communication link to obtain the typical time value of the communication link;

[0066] S233, using the traffic characteristic function, calculate the typical time value of each communication link to obtain the typical traffic value of the communication link.

[0067] The process of modeling traffic characteristics for the traffic information sequences of all communication links to obtain traffic characteristic functions includes:

[0068] S2311, For each communication link's traffic information sequence, with the acquisition time as the independent variable and the traffic information as the dependent variable, perform autoregressive-moving average modeling on the independent and dependent variables to obtain the corresponding regression models.

[0069] S2312, extract the coefficient vector of the regression model for all communication links;

[0070] S2313, perform cross-correlation calculation on the coefficient vectors of the regression models of all communication links to obtain a cross-correlation matrix; the elements in the i-th row and j-th column of the cross-correlation matrix are the cross-correlation values ​​of the coefficient vectors of the regression models of the i-th and j-th communication links.

[0071] S2314, Perform singular value calculation on the cross-correlation matrix to obtain a singular value sequence;

[0072] S2315, using the element values ​​of the singular value sequence as known dependent variables and the element indices of the singular value sequence as known independent variables, a curve to be approximated is constructed using the known independent variables and the known dependent variables; polynomial fitting is performed on the curve to be approximated to obtain the flow characteristic function;

[0073] The constructed traffic feature function utilizes the ARMA model to capture the temporal dependence of traffic, making it suitable for predicting short-term traffic change trends and demonstrating good detection performance against time-series-based attacks (such as pulsed DoS). Through cross-correlation matrix and singular value decomposition, it uncovers collaborative change patterns between links, identifying complex anomalies such as traffic shifting and cross-link attacks. Singular value decomposition transforms high-dimensional coefficient vectors into low-dimensional singular value sequences, reducing computational complexity while preserving key features and improving the model's scalability to large-scale networks.

[0074] The autoregressive moving average modeling can be performed using the ARMA method.

[0075] The step of performing typical time calculations on the traffic information sequence of each communication link to obtain the typical time value of the communication link includes:

[0076] S2321, For the values ​​of the traffic information sequence of each communication link, perform value distribution statistics to obtain the corresponding value probability distribution function and value distribution probability; the value distribution probability is the distribution probability of the traffic information sequence values ​​within each preset value interval;

[0077] S2322, perform fusion probability calculation on the probability distribution of the values ​​to obtain the feature probability value;

[0078] S2323, Based on the value probability distribution function, determine the value corresponding to the feature probability value in the value probability distribution function, which is the feature probability value;

[0079] S2324, find the collection time corresponding to the traffic information value that is closest to the feature probability value in the traffic information sequence, which is the typical time value of the communication link.

[0080] The typical time calculation is based on probability distribution to determine characteristic probability values, and then selects the most representative time point, avoiding information loss or abnormal dilution that may be caused by traditional methods using fixed time windows (such as 5-minute averages). By using probability distribution statistics rather than directly comparing the original traffic values, random noise interference is effectively suppressed, and robustness is provided to sudden short-term traffic fluctuations (such as legitimate business peaks).

[0081] The expression for calculating the fusion probability is:

[0082]

[0083] Where DT is the feature probability value, P i Let H be the probability distribution of the i-th value interval, and H be the total number of value intervals.

[0084] The fusion probability calculation highlights the non-uniformity of traffic distribution by calculating the weighted sum of the probabilities of each interval and the deviation from the uniform distribution. When traffic is concentrated in a few intervals (such as attack traffic characteristics), the DT value deviates significantly from the normal range, enabling sensitive detection of hidden anomalies. No preset threshold is required; the characteristic probability value is calculated directly based on the traffic's own distribution characteristics, automatically adapting to differences in traffic patterns under different network environments (such as traffic distribution changes during peak and off-peak periods).

[0085] The value corresponding to the characteristic probability value in the value probability distribution function is called the characteristic probability value, which is the value of the independent variable corresponding to the value probability distribution function when the probability value is determined to be the characteristic probability value.

[0086] The process of performing protection monitoring on the real-time network traffic information set based on the standard traffic information set to obtain monitoring result information includes:

[0087] S31, based on the standard traffic information set, performs feature monitoring processing on the typical traffic values ​​of all communication links to obtain traffic feature monitoring values;

[0088] S32, based on the standard traffic information set, performs global monitoring processing on the three-dimensional matrix of traffic information to obtain global traffic monitoring values;

[0089] S33, based on the preset traffic monitoring value range, the traffic feature monitoring value and the global traffic monitoring value are processed to obtain monitoring result information.

[0090] The process of protecting and monitoring the real-time network traffic information set involves using feature monitoring to focus on abnormal characteristics of individual links (such as sudden traffic changes and distribution shifts) and global monitoring to detect abnormal propagation at the network topology level (such as cascading failures and abnormal traffic routing), forming a complementary approach. Combining feature monitoring values ​​with global monitoring values ​​reduces false alarm rates. For example, if a link shows abnormal features but there are no related abnormalities globally, it can be determined as a local fluctuation rather than an attack.

[0091] The expression for the feature monitoring process is:

[0092]

[0093] Where lt is the traffic characteristic monitoring value, N is the total number of communication links, and θ i Let θ0 and θ be the typical traffic values ​​for the i-th communication link. 20 θ 10 These are the standard traffic value, upper traffic limit, and lower traffic limit for the communication link, respectively.

[0094] E(θ i Let (θ0) be the integral function, and its expression is:

[0095]

[0096] Where k is a basic variable.

[0097] The feature monitoring process is performed through the integral function E(θ). i The ratio of the typical flow rate to the standard flow rate ( / θ0) is nonlinearly transformed to make the monitoring system more sensitive to flow rate changes close to the standard value (the integral function at θ0). i The rate of change is large near θ0≈1, but it remains robust to abnormal flow rates far from the standard value. This is achieved using trigonometric functions. At the upper bound of the flow θ 20 and lower bound θ 10 The singularity in the vicinity means that when the typical flow rate approaches the threshold boundary, the monitored value lt will change drastically, enabling a rapid response to critical anomalies.

[0098] Integral function through the From negative infinity to θ i The accumulation of / θ0 can capture the abnormal cumulative effect in long-term traffic change trends. For example, slowly increasing abnormal traffic (such as in a data breach scenario) may not trigger the threshold once, but after accumulation through integration, it will significantly increase the E value and eventually be detected. The function exhibits exponential growth when k>0 and oscillating decay when k<0, allowing the integral result to automatically adapt to traffic fluctuations of different magnitudes. It demonstrates good detection performance for anomalies in both low-traffic links (such as IoT device anomalies) and high-traffic links (such as backbone network attacks).

[0099] The process of globally monitoring the three-dimensional matrix of traffic information based on a standard traffic information set to obtain global traffic monitoring values ​​includes:

[0100] Subtracting the standard value of the flow information from the three-dimensional matrix of flow information yields the first three-dimensional difference matrix.

[0101] The second difference three-dimensional matrix is ​​obtained by calculating the maximum difference between the three-dimensional matrix of traffic information and the upper and lower bounds of traffic.

[0102] Perform full-rank decomposition on the first and second difference three-dimensional matrices respectively to obtain the corresponding pattern-1 matrix;

[0103] Singular value decomposition is performed on the two obtained pattern-1 matrices to obtain the corresponding singular value sets;

[0104] Perform global traffic monitoring calculations on the singular value sets of the two matrices to obtain global traffic monitoring values.

[0105] The expression for calculating the global traffic monitoring is:

[0106]

[0107] Where φ is a preset constant factor, γ1 is the global traffic monitoring value, and r1 i and r2 i Let i be the i-th element of the singular value set corresponding to the two pattern-1 matrices.

[0108] The maximum difference calculation involves subtracting each element of the three-dimensional flow information matrix from both the upper and lower flow bounds and taking the absolute value. The maximum of the two results is then taken as the corresponding element value in the second three-dimensional difference matrix.

[0109] A second aspect of the present invention discloses an information protection and monitoring device for computer networks, the device comprising:

[0110] Memory containing executable program code;

[0111] A processor coupled to the memory;

[0112] The processor calls the executable program code stored in the memory to execute the information protection and monitoring method for the computer network.

[0113] In a third aspect of this invention, a computer-storable medium is disclosed, wherein the computer-storable medium stores computer instructions, and when the computer instructions are invoked by a computer, they are used to execute the information protection and monitoring method for the computer network.

[0114] A fourth aspect of the present invention discloses an information data processing terminal, which is used to implement the information protection and monitoring method for computer networks.

[0115] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for information protection and monitoring of a computer network, characterized in that, include: S1, obtain the set of computer network topology information and standard traffic information; The topology information includes the connection relationships between various nodes of the computer network; the standard traffic information set includes the standard traffic value, upper traffic limit, and lower traffic limit of the communication link between every two interconnected nodes of the computer network. S2, based on the topology information, perform traffic monitoring on the computer network to obtain a set of real-time network traffic information, including: S21, based on the topology information, monitor the communication links between every two interconnected nodes of the computer network to obtain a traffic information sequence of the communication links within a preset time interval; the traffic information sequence is a sequence of traffic information collected at several collection times within the preset time interval. S22, representing the sequence of traffic information of all communication links as a three-dimensional matrix of traffic information; S23, for the traffic information sequence of each communication link, perform traffic typical value modeling and calculation to obtain the traffic typical value of the communication link, including: S231, perform traffic feature modeling on the traffic information sequence of all communication links to obtain the traffic feature function; S232, Perform typical time calculation on the traffic information sequence of each communication link to obtain the typical time value of the communication link; S233, using the traffic characteristic function, calculate the typical time value of each communication link to obtain the typical traffic value of the communication link; S24. Using the three-dimensional matrix of traffic information and the typical traffic values ​​of all communication links, a set of real-time network traffic information is constructed; S3. Based on the standard traffic information set, the set of real-time network traffic information is subjected to protection and monitoring processing to obtain monitoring result information.

2. The information protection and monitoring method for computer networks as described in claim 1, characterized in that, The process of modeling traffic characteristics for the traffic information sequences of all communication links to obtain traffic characteristic functions includes: S2311, For each communication link's traffic information sequence, with the acquisition time as the independent variable and the traffic information as the dependent variable, perform autoregressive-moving average modeling on the independent and dependent variables to obtain the corresponding regression models. S2312, extract the coefficient vector of the regression model for all communication links; S2313, perform cross-correlation calculation on the coefficient vectors of the regression models of all communication links to obtain a cross-correlation matrix; the elements in the i-th row and j-th column of the cross-correlation matrix are the cross-correlation values ​​of the coefficient vectors of the regression models of the i-th and j-th communication links. S2314, Perform singular value calculation on the cross-correlation matrix to obtain a singular value sequence; S2315, using the element values ​​of the singular value sequence as known dependent variables and the element indices of the singular value sequence as known independent variables, a curve to be approximated is constructed using the known independent and dependent variables; polynomial fitting is performed on the curve to be approximated to obtain the flow characteristic function.

3. The information protection and monitoring method for computer networks as described in claim 1, characterized in that, The step of performing typical time calculations on the traffic information sequence of each communication link to obtain the typical time value of the communication link includes: S2321, For the values ​​of the traffic information sequence of each communication link, perform value distribution statistics to obtain the corresponding value probability distribution function and value distribution probability; the value distribution probability is the distribution probability of the element values ​​of the traffic information sequence within each preset value interval; S2322, perform fusion probability calculation on the probability distribution of the values ​​to obtain the feature probability value; S2323, Based on the value probability distribution function, determine the value corresponding to the feature probability value in the value probability distribution function, which is the feature probability value; S2324, find the collection time corresponding to the traffic information value that is closest to the feature probability value in the traffic information sequence, which is the typical time value of the communication link.

4. The information protection and monitoring method for computer networks as described in claim 3, characterized in that, The expression for calculating the fusion probability is: Where DT is the feature probability value, P i Let H be the probability distribution of the i-th value interval, and H be the total number of value intervals.

5. The information protection and monitoring method for computer networks as described in claim 1, characterized in that, The process of performing protection monitoring on the real-time network traffic information set based on the standard traffic information set to obtain monitoring result information includes: S31, based on the standard traffic information set, performs feature monitoring processing on the typical traffic values ​​of all communication links to obtain traffic feature monitoring values; S32, based on the standard traffic information set, performs global monitoring processing on the three-dimensional matrix of traffic information to obtain global traffic monitoring values; S33, based on the preset traffic monitoring value range, the traffic feature monitoring value and the global traffic monitoring value are processed to obtain monitoring result information.

6. An information protection and monitoring device for a computer network, characterized in that, The device includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the information protection and monitoring method for computer networks as described in any one of claims 1 to 5.

7. A computer-storable medium, characterized in that, The computer storage medium stores computer instructions, which, when invoked by the computer, are used to execute the information protection and monitoring method for the computer network as described in any one of claims 1 to 5.

8. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the information protection and monitoring method for computer networks as described in any one of claims 1 to 5.

Images