Data transmission method and device based on network gateway and medium

Abstract

The invention relates to the technical field of data transmission, in particular to a data transmission method and device based on a network gateway and a medium, and the method comprises the steps: obtaining a network data packet passing through the network gateway, and determining and obtaining the current state information and previous state information of a communication node in an analysis time window based on the network data packet; based on the current state information, performing first state evaluation on the communication node to obtain a first state evaluation result; performing second state evaluation on the communication node based on the current state information and the previous state information to obtain a second state evaluation result; based on the first state evaluation result and the second state evaluation result, performing third state evaluation on the communication node to obtain a third state evaluation result; and performing corresponding data transmission on the network data packet corresponding to the communication node according to the first state evaluation result, the second state evaluation result and the third state evaluation result. The method and the device have the effect of improving the security and the efficiency in the data transmission process.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and in particular to a data transmission method, device and medium based on a network gateway. Background Technology

[0002] Currently, network gateways, as key nodes connecting different networks such as corporate intranets and the Internet, are crucial gatekeepers for ensuring network information security. During data transmission, network gateways need to monitor and analyze network data packets flowing through them in real time to identify and handle various abnormal or malicious network communications, thereby protecting internal network resources and data from attacks.

[0003] To achieve the aforementioned security functions, network gateways typically integrate security mechanisms such as firewalls or intrusion detection systems (IDS). When conducting data transmission security assessments, these mechanisms usually involve sampling and statistically analyzing network traffic within a fixed time window. They primarily rely on comparing individual network behavior metrics, such as traffic rate and connection count, with a pre-configured, static absolute threshold. When a metric exceeds the threshold, it is considered abnormal. While this approach can intercept some attacks with obvious traffic characteristics, the fixed analysis window generally cannot adapt to dynamic changes in network traffic. This can lead to response delays during peak traffic periods and waste computational resources during off-peak periods. Furthermore, relying solely on static absolute thresholds is insufficient to effectively identify attacks with subtle but suspicious patterns. For example, it is insensitive to drastic changes in metric values ​​at the initial stage of an attack and struggles to effectively address increasingly complex network threats. Therefore, there is room for improvement. Summary of the Invention

[0004] To improve the security and efficiency of data transmission, this application provides a data transmission method, device, and medium based on a network gateway.

[0005] The above-mentioned objective of this application is achieved through the following technical solution: A data transmission method based on a network gateway, the data transmission method based on a network gateway includes: Obtain network data packets passing through the network gateway, and determine the analysis time window based on the network data packets; Within the analysis time window, the current status information of the communication nodes in the network is obtained, and the previous status information of the communication nodes in the previous analysis time window is obtained. Based on the current state information, the communication node is evaluated according to a first preset benchmark to obtain the first state evaluation result of the communication node. Based on the current state information and the previous state information, a second state evaluation is performed on the communication node to obtain the second state evaluation result of the communication node; Based on the first state evaluation result and the second state evaluation result, the communication node is evaluated in a third state through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node. Based on the first state evaluation result, the second state evaluation result, and the third state evaluation result, the network data packets corresponding to the communication node are transmitted accordingly.

[0006] By adopting the above technical solution and determining the analysis time window based on network data packets, the rhythm and granularity of the analysis can be adjusted according to the real-time network load. This ensures the timeliness of the analysis during peak traffic periods and saves computing resources during off-peak traffic periods, improving adaptability and efficiency. By acquiring the current and previous state information of communication nodes, it is possible to grasp the static behavior snapshots and dynamic change trends of nodes over continuous time. By conducting first, second, and third state assessments, a progressive and comprehensive security analysis of the behavior of communication nodes can be performed from three dimensions: static magnitude, dynamic change, and temporal correlation. This greatly enhances the ability to identify complex, multi-stage, and covert attacks and reduces the false negative rate of traditional single detection methods. By transmitting network data packets according to all assessment results, the abstract security assessment can be transformed into control actions on network data packets, thereby achieving closed-loop control from risk perception to threat handling and ensuring the security of data transmission.

[0007] In a preferred embodiment, this application can be further configured such that, prior to the step of determining the analysis time window based on the network data packets, the data transmission method based on a network gateway further includes: Based on the network data packets, the trust score of the communication node is obtained, and based on the trust score, the authentication level of the communication node is determined. Based on the authentication level of the communication node and a preset authentication mechanism, the communication node is authenticated to obtain the authentication result.

[0008] By adopting the above technical solution, and by obtaining the trust score of the communication node and determining its authentication level, a security reputation rating can be established for each communication node, which improves the granularity of the security policy. By authenticating the communication node according to the authentication level, different levels of authentication checks can be implemented for nodes with different reputation levels. This ensures that high-risk nodes are strictly reviewed while providing a fast channel for trusted nodes, thus achieving a balance between security and efficiency.

[0009] In a preferred embodiment, this application can be further configured as follows: Authenticating the communication node based on its authentication level and a preset authentication mechanism to obtain an authentication result specifically includes: If the authentication level of the communication node is high trust level, then the fast authentication channel is invoked to authenticate the communication node. If the signature of the communication node is correct and the authentication is within the validity period, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated. If the authentication level of the communication node is the standard trust level, then the encrypted authentication channel is invoked to authenticate the communication node. If the random signature of the communication node is correct, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated. If the authentication level of the communication node is low trust level, then the enhanced challenge channel is invoked to authenticate the communication node, and the random signature of the communication node is determined to be correct. If the random signature of the communication node is correct, the data verification answer returned by the communication node is obtained. If the data verification answer is correct, the authentication result of passing is generated; otherwise, the authentication result of failing is generated. If the authentication level of the communication node is untrusted, then an authentication failure result is generated.

[0010] By adopting the above technical solution and calling the fast authentication channel for high-trust-level nodes, a lightweight and low-latency verification method can be provided, which significantly reduces the authentication complexity of trusted communication, improves the overall processing performance of the gateway and the user experience. By calling the encrypted authentication channel and the enhanced challenge channel for standard-trust-level and low-trust-level nodes respectively, the authentication strength and the attack cost for attackers can be gradually increased according to the increase of risk level, thereby building a hierarchical defense-in-depth system to ensure effective control over the secure access of unknown and suspicious nodes.

[0011] In a preferred embodiment, this application can be further configured such that determining the analysis time window based on the network data packets specifically includes: Obtain global traffic statistics from the network data packets, wherein the global traffic statistics include at least the total data packet rate and the total connection rate; The global traffic statistics are matched with a preset traffic level analysis time mapping table to obtain the corresponding analysis time window duration. The analysis time window is then determined based on the analysis time window duration.

[0012] By adopting the above technical solution, global traffic statistics indicators are obtained from network data packets, and these indicators are matched with a preset traffic level analysis time mapping table to determine the analysis time window. This allows the analysis cycle to be set according to the current network load, thereby avoiding the response lag or resource waste caused by using a fixed window duration and improving the efficiency and responsiveness of the entire analysis system.

[0013] In a preferred embodiment, this application can be further configured as follows: based on the current state information, performing a first state evaluation on the communication node according to a first preset benchmark to obtain a first state evaluation result for the communication node specifically includes: Based on a first preset benchmark, the absolute state threshold of each indicator type is obtained, and the current state information is compared with the corresponding absolute state threshold according to the indicator type to obtain a first comparison result. Based on the comparison results, if at least one indicator value in the current state information exceeds the corresponding absolute state threshold, a first state evaluation result of abnormal state is generated; otherwise, a first state evaluation result of normal state is generated.

[0014] By adopting the above technical solution, the network behavior index values ​​of communication nodes are compared with preset absolute state thresholds, and evaluation results are generated based on whether the limits are exceeded. This allows for the rapid and direct identification of communication nodes whose behavior levels constitute obvious anomalies. This provides a basic and highly efficient anomaly screening condition for the entire detection system, enabling the capture of the most direct threat signals at the first moment.

[0015] In a preferred embodiment, this application can be further configured such that: the second state evaluation of the communication node based on the current state information and the previous state information, to obtain the second state evaluation result of the communication node, specifically includes: By performing numerical calculations on the current state information and the previous state information for corresponding indicator types, the state change difference of each indicator type is calculated. The state change difference of each of the aforementioned indicator types is compared with the corresponding preset jump threshold to obtain a second comparison result; Based on the second comparison result, if the difference in state change for at least one indicator type exceeds the corresponding preset jump threshold, a second state evaluation result indicating abnormal behavior mutation is generated; otherwise, a second state evaluation result indicating normal state change is generated.

[0016] By adopting the above technical solution, by calculating the difference in the state changes of behavioral indicators in adjacent time windows and determining whether the difference exceeds the preset jump threshold, it is possible to discover potential threats whose absolute values ​​may still be within the normal range, but whose behavior changes drastically in a short period of time. This makes up for the shortcomings of relying solely on absolute threshold detection and provides higher sensitivity and early warning capabilities for dynamic threats such as sudden attacks after lurking.

[0017] In a preferred embodiment, this application can be further configured as follows: based on the first state evaluation result and the second state evaluation result, a third state evaluation is performed on the communication node through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node, specifically including: If the first state assessment result is an abnormal state and / or the second state assessment result is a behavioral mutation abnormality, then based on the first state assessment result and the second state assessment result, the corresponding behavioral label sequence is obtained by matching with a predefined behavioral label definition library; Based on the sequence analysis mechanism, the behavior tag sequence is matched to obtain a matching result. According to the matching result, if the behavior tag sequence successfully matches a preset dangerous behavior combination pattern, a third state evaluation result of identifying a composite attack event is generated; otherwise, a third state evaluation result of not identifying a composite attack event is generated. If the first state assessment result is "normal" and the second state assessment result is "normal state change", then a third state assessment result is generated indicating that no composite attack event was identified.

[0018] By adopting the above technical solution, abstracting the abnormal assessment results into behavioral labels, and using sequence analysis mechanisms to analyze the temporal order of these labels to match dangerous behavioral combination patterns, it is possible to link multiple independent and seemingly harmless or low-risk behaviors together, identify the composite behavioral patterns that they jointly constitute and have specific attack logic, thereby greatly improving the detection capability of advanced attack techniques such as multi-stage and slow attacks, and enhancing the ability to identify attack behaviors.

[0019] In a preferred embodiment, this application can be further configured such that: the step of transmitting network data packets corresponding to the communication node based on the first state evaluation result, the second state evaluation result, and the third state evaluation result specifically includes: If the first state assessment result is an abnormal state and / or the second state assessment result is an abnormal behavior mutation and / or the third state assessment result is the identification of a compound attack event, then based on the preset risk handling strategy mapping table, risk handling operations are performed on the network data packets corresponding to the communication node. The risk handling operations include at least blocking the transmission of the network data packets and limiting the transmission rate of the network data packets. If the first state assessment result is normal, the second state assessment result is normal state change, and the third state assessment result is no composite attack event detected, then the network data packets corresponding to the communication node will be forwarded normally to allow data transmission.

[0020] By adopting the above technical solution, and by making decisions and executing differentiated data transmission operations based on the comprehensive results of all assessment stages, it is possible to implement matching control measures for communication traffic of different risk levels. This ensures that high-risk traffic is effectively blocked or restricted while guaranteeing smooth communication for the vast majority of normal traffic, achieving the best balance between security and business availability.

[0021] The above-mentioned objective 2 of this application is achieved through the following technical solution: A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described data transmission method based on a network gateway.

[0022] The above-mentioned objective three of this application is achieved through the following technical solution: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described data transmission method based on a network gateway.

[0023] In summary, this application includes at least one of the following beneficial technical effects: 1. By determining the analysis time window based on network data packets, the analysis rhythm and granularity can be adjusted according to the real-time network load, thus ensuring the timeliness of analysis during peak traffic periods and saving computing resources during off-peak traffic periods, improving adaptability and efficiency. By acquiring the current and previous state information of communication nodes, the static behavior snapshot and dynamic change trend of nodes over continuous time can be grasped. By performing first, second, and third state assessments, the behavior of communication nodes can be analyzed in a progressive and comprehensive manner from three dimensions: static magnitude, dynamic change, and temporal correlation. This greatly enhances the ability to identify complex, multi-stage, and covert attacks and reduces the false negative rate of traditional single detection methods. By transmitting network data packets according to all assessment results, the abstract security assessment can be transformed into control actions on network data packets, thereby realizing closed-loop control from risk perception to threat handling and ensuring the security of data transmission. 2. By making decisions and executing differentiated data transmission operations based on the comprehensive results of all assessment stages, it is possible to implement matching control measures for communication traffic of different risk levels. This ensures that high-risk traffic is effectively blocked or restricted while guaranteeing smooth communication for the vast majority of normal traffic, achieving the best balance between security and business availability. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the implementation of a data transmission method based on a network gateway in one embodiment of this application. Figure 2 This is another implementation flowchart of the data transmission method based on a network gateway in one embodiment of this application. Figure 3 This is a flowchart illustrating the implementation of step S102 in a data transmission method based on a network gateway in one embodiment of this application. Figure 4 This is a flowchart illustrating the implementation of step S10 in a data transmission method based on a network gateway in one embodiment of this application. Figure 5 This is a flowchart illustrating step S30 of a data transmission method based on a network gateway in one embodiment of this application. Figure 6 This is a flowchart illustrating step S40 of a data transmission method based on a network gateway in one embodiment of this application. Figure 7 This is a flowchart illustrating step S50 of a data transmission method based on a network gateway in one embodiment of this application. Figure 8 This is a flowchart illustrating step S60 in a data transmission method based on a network gateway in one embodiment of this application. Figure 9This is a schematic diagram of the internal structure of a computer device according to an embodiment of this application. Detailed Implementation

[0025] The following embodiments will help those skilled in the art to further understand the function of this application, but do not limit this application in any way. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of this application. These all fall within the protection scope of this application.

[0026] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0027] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0028] The present application will be further described in detail below with reference to the accompanying drawings.

[0029] In one embodiment, such as Figure 1 As shown, this application discloses a data transmission method based on a network gateway, which specifically includes the following steps: S10: Obtain network packets passing through the network gateway, and determine the analysis time window based on the network packets.

[0030] Specifically, a network data packet refers to the basic data unit encapsulated and transmitted in a digital communication network to achieve data exchange. It typically includes a header with address information such as source / destination IP addresses and ports, and a payload carrying the actual communication content. For example, all data involved in a web browsing activity, such as requests, text, and images, will be broken down into tens of thousands of independent network data packets for transmission. The analysis time window refers to a time span set for data collection and analysis to process continuous data streams. Determining the analysis time window is a dynamic decision-making process. For example, a dynamic analysis period can be set based on the overall density of the network data packets being processed. When the data stream is busy, a shorter window of 1 second can be set for rapid response, while a window of 5 seconds can be set when the data stream is slow to save analysis resources, thereby achieving flexible adjustment of the analysis frequency.

[0031] S20: Within the analysis time window, obtain the current status information of the communication nodes in the network, and obtain the previous status information of the communication nodes in the previous analysis time window.

[0032] Specifically, the current status information is a set of data indicators reflecting the current operating status of the communication node, while the previous status information is the same data indicator recorded by the node in the previous period. This status information may include, but is not limited to, the node's central processing unit (CPU) load percentage, memory usage, number of network connections, packet sending rate, etc. For example, if the CPU load of a server node is 50% in the current 1-second analysis window, and the CPU load was 48% in the previous 1-second window, these two sets of information constitute the current status information and the previous status information, respectively, providing the original data basis for subsequent comparative evaluation.

[0033] S30: Based on the current state information, perform a first state evaluation on the communication node according to the first preset benchmark, and obtain the first state evaluation result of the communication node.

[0034] Specifically, the evaluation process compares the acquired current status information with a benchmark representing a normal or safe operating state. This first preset benchmark can be a set of empirical values, and its function is to quickly determine whether the current state of the node is within an acceptable absolute range. This is the first dimension in the multi-dimensional state evaluation: static magnitude detection. For example, if the first preset benchmark defines that the number of concurrent connections of a normal communication node should not exceed 1,000, and the acquired current status information shows that the number of concurrent connections of a certain node has reached 2,000, then the first state evaluation result will be marked as abnormal; otherwise, if it is 500, it will be marked as normal.

[0035] S40: Based on the current state information and the previous state information, perform a second state evaluation on the communication node to obtain the second state evaluation result of the communication node.

[0036] Specifically, this assessment focuses on analyzing the behavioral change trends of communication nodes in a short period of time. It is achieved by calculating the degree of deviation of the current state information from the previous state information. This is the second dimension of the multi-dimensional state assessment: dynamic change detection. It can capture sudden behaviors that are difficult to detect with static thresholds. For example, the number of connections of a node suddenly increases from 50 in the previous window to 500 in the current window. Although the absolute value of 500 may still be within the normal range of the first state assessment, this 10-fold growth rate is itself a drastic behavioral fluctuation. The second state assessment will identify it and obtain an assessment result representing an abnormal behavioral change.

[0037] S50: Based on the first state evaluation result and the second state evaluation result, the communication node is evaluated in the third state through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node.

[0038] Specifically, this is the core third dimension of the multi-dimensional state assessment: contextual analysis. By comprehensively analyzing the results of the first two assessments, it identifies more complex and continuous potential threat behaviors. The pre-set sequence analysis mechanism can understand the internal logic and risk level of different abnormal state combinations. For example, when the first state assessment result shows that a node is in an abnormal state, such as a port being continuously accessed, and then the second state assessment result shows a sudden change in behavior, such as a sudden surge in outbound traffic, the sequence analysis mechanism will link these two isolated results together and determine that this may be a typical attack sequence in which a node is first scanned and probed, then successfully implanted with a Trojan horse and launches an attack, thereby generating a third state assessment result that identifies a composite attack.

[0039] S60: Based on the first state evaluation result, the second state evaluation result, and the third state evaluation result, perform corresponding data transmission on the network data packets corresponding to the communication node.

[0040] Specifically, the results obtained from all the preceding assessment steps will be comprehensively analyzed and then the actual network control actions will be taken to ensure that the measures are matched with the perceived risk level and to achieve closed-loop risk management. For example, if any of the above assessment results indicate an anomaly or attack event, the subsequent network data packets of the communication node will be intercepted, either by directly discarding the data packets or by limiting the transmission rate of the network data packets. Conversely, if all assessment results show that everything is normal, the network data packets of the node will be forwarded normally, allowing them to be transmitted freely in the network, thereby ensuring the security and smooth operation of the network environment.

[0041] In one embodiment, such as Figure 2 As shown, prior to step S10, the data transmission method based on the network gateway further includes: S101: Based on network data packets, obtain the trust score of the communication node, and determine the authentication level of the communication node based on the trust score.

[0042] Specifically, the trust score refers to a dynamically changing score maintained for each communication node to quantify its security reputation. It is each node's credit score, and the update of this score is based on at least the communication node's past security assessment results, thereby achieving adaptive adjustment of the trust level. The authentication level refers to a preset security review level corresponding to different trust score ranges. This is achieved by matching the real-time trust score value obtained from the acquired network data packets with a preset score-level mapping table. For example, a score greater than 85 corresponds to a high trust level, 50 to 85 corresponds to a standard trust level, 20 to 50 corresponds to a low trust level, and a score less than 20 corresponds to an untrusted level.

[0043] For example, when a communication node is initially identified, its identity is compared with a preset static identity database. If the node is a known trusted partner, it is assigned a high base trust score, such as 70 points; otherwise, it is assigned a neutral initial trust score, such as 30 points. Furthermore, the node's trust score is updated in real time based on the historical security assessment results generated in each analysis cycle. This means that rewards and penalties are applied immediately based on behavior. For instance, generating a low-risk state deviation event will slightly decrease the trust score, such as deducting 5 points, while generating a medium-risk state drastic change event will result in a decrease in the score. A decrease in trust score can result in a deduction of 20 points, while a high-risk compound attack can lead to a significant deduction of 50 points. The system also includes a long-term reputation adjustment mechanism. For example, nodes that have consistently performed well and have not triggered any abnormal events will see their trust score gradually increase by 5 points daily until it reaches its maximum. Conversely, nodes that have been inactive for a long time may have their trust score gradually decrease over time. Through this comprehensive system of initial assignment, real-time rewards and penalties, and long-term adjustments, the resulting quantitative trust score can comprehensively and dynamically reflect the current trustworthiness of the communication node.

[0044] S102: Based on the authentication level of the communication node and a preset authentication mechanism, authenticate the communication node and obtain the authentication result.

[0045] Specifically, the preset authentication mechanism is a set of strategies that includes authentication schemes with different strengths and complexities. It is linked to the authentication level determined in the previous step. For example, for nodes determined to be of high trust level, an authentication method based on session tokens for fast verification will be invoked. For nodes of standard trust level, an authentication method based on asymmetric encryption and including a random query-response process will be invoked. For nodes of low trust level, after completing the standard encryption authentication, they may need to complete an additional challenge of a computational problem. After being authenticated by any of the above authentication methods, an authentication result is obtained. This result is the key signal that determines whether the entire data transmission process can continue. Only when the authentication result is successful can the network data packets of the communication node be eligible to enter the determination analysis time window and subsequent deeper state evaluation stages.

[0046] In one embodiment, such as Figure 3 As shown, in step S102, the communication node is authenticated based on its authentication level and a preset authentication mechanism to obtain the authentication result. Specifically, this includes: S1021: If the authentication level of the communication node is high trust level, the fast authentication channel is invoked to authenticate the communication node. If the signature of the communication node is correct and the authentication is within the validity period, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated.

[0047] Specifically, the fast authentication channel is a lightweight verification path designed for high-reputation nodes that minimizes authentication overhead. The logic of fast authentication is that the communication node is required to provide a session token recently issued by the gateway system with a time limit in the request. Then, the digital signature of the session token is verified by the internal key held by the gateway to confirm that the token has not been forged or tampered with, thereby confirming the correctness of its digital signature. By analyzing the content of the token, the expiration timestamp in the token is compared with the current server time to ensure that the token has not expired, that is, whether the authentication is within the validity period. Only when both signature and time limit verifications pass, an authentication result is generated, thereby achieving efficient processing of trusted nodes while ensuring basic security.

[0048] S1022: If the authentication level of the communication node is the standard trust level, the encrypted authentication channel is invoked to authenticate the communication node. If the random signature of the communication node is correct, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated.

[0049] Specifically, the encrypted authentication channel is a standard security verification process based on asymmetric encryption technology, used to verify the authenticity of a communication node whose identity has not been highly trusted beforehand. The logic of this encrypted authentication is a challenge-response mechanism. First, the gateway generates a one-time and unpredictable random data as a challenge and sends it to the communication node. Then, the communication node must use the private key corresponding to its claimed identity to digitally sign the received challenge, that is, to perform random signature verification, and return the signature result as a response. Subsequently, the gateway uses the public key corresponding to the identity to verify the response. If the signature can successfully match the original challenge, that is, the random signature is correct, it proves that the node does indeed hold the corresponding private key and its identity is legitimate, thus generating an authentication result that has passed the authentication.

[0050] S1023: If the authentication level of the communication node is low trust level, the enhanced challenge channel is invoked to authenticate the communication node and determine whether the random signature of the communication node is correct. If the random signature of the communication node is correct, the data verification answer returned by the communication node is obtained. If the data verification answer is correct, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated.

[0051] Specifically, the enhanced challenge channel is a high-friction authentication process designed for low-reputation and high-suspicion nodes, containing multiple verification levels. Its purpose is to increase the cost of automated attacks. This authentication process first requires the communication node to successfully complete the encrypted challenge-response process based on random signature in step S1022, thus constituting the first layer of identity verification. On this basis, the gateway will further issue a computationally intensive data verification task, such as a computational puzzle that requires computing power to solve, i.e., proof-of-work. The result returned by the communication node after successfully solving the puzzle within the specified time is the data verification answer. The gateway can then verify the correctness of the answer. Only when this second layer of verification is also passed will the final authentication result be generated.

[0052] S1024: If the authentication level of the communication node is untrusted, then an authentication failure result is generated.

[0053] Specifically, when the authentication level of a communication node is determined to be untrusted, it means that its dynamic trust score has fallen below the minimum tolerance threshold and it is judged as a high-risk or malicious node. In this case, the system will skip all actual authentication interaction processes, without sending any challenges or receiving any responses. Instead, it will directly set the authentication result of this authentication as authentication failure, rejecting known high-risk connections with the fastest speed and minimum resource consumption, and immediately triggering subsequent data transmission blocking strategies, thereby protecting the gateway itself from potential resource-consuming attacks.

[0054] In one embodiment, such as Figure 4 As shown, in step S10, which determines the analysis time window based on network data packets, the specific steps include: S11: Obtain global traffic statistics from network packets. Global traffic statistics include at least the total packet rate and the total connection rate.

[0055] Specifically, global traffic statistics metrics refer to a set of parameters used to macroscopically measure the load of all network data packets currently passing through the network gateway, providing a quantitative basis for subsequent dynamic decision-making. Among them, total packet rate (PPS) refers to the sum of all network data packets flowing through the gateway per unit time, which reflects the original volume of network communication and bandwidth pressure, while total connection rate (CPS) refers to the total number of new network connections established per unit time, which reflects the frequency and density of service requests.

[0056] S12: Match the global traffic statistics indicators with the preset traffic level analysis time mapping table to obtain the corresponding analysis time window duration, and determine the analysis time window based on the analysis time window duration.

[0057] Specifically, the traffic tier analysis time mapping table is a pre-configured set of rules in the gateway that defines the association between different network load levels and corresponding analysis strategies. It's similar to a pre-set temperature-fan speed lookup table for a smart air conditioner. The matching process includes a priority judgment mechanism, which prioritizes determining whether the total connection rate (CPS) has triggered a high-risk condition. For example, a high-priority rule in this mapping table might be defined as follows: if the total connection rate exceeds a high-risk threshold, such as 5000 CPS, then regardless of the total packet rate (PPS), the shortest analysis time window, such as 30 seconds, is immediately matched. If the total connection rate is within the normal range, such as 0-2... If the CPS reaches 500, the second-level matching logic is entered. At this point, the judgment is based on the total packet rate (PPS). For example, if the total packet rate is less than 1000 PPS, the corresponding analysis time window is 120 seconds. If the total packet rate is between 1000 and 50000 PPS, the corresponding time window is 60 seconds. Through this matching logic that includes priority judgment and combines PPS and CPS, the analysis time window is obtained, which reflects the current security status of the network and is ultimately determined as the unified period for all subsequent state assessments, thus completing the dynamic adaptive adjustment of the entire analysis.

[0058] In one embodiment, such as Figure 5 As shown, in step S30, based on the current state information and according to the first preset benchmark, a first state evaluation is performed on the communication node to obtain the first state evaluation result of the communication node, specifically including: S31: Based on the first preset benchmark, obtain the absolute state threshold of each indicator type, compare the current state information with the corresponding absolute state threshold according to the indicator type, and obtain the first comparison result.

[0059] Specifically, the first preset benchmark refers to a set of pre-configured rules used to define the normal boundaries of various network behavior indicators. By obtaining each specific indicator, such as connection frequency, contained in the current state information from this set of rules, the corresponding upper and lower limits of its normal value range are found, thus obtaining the absolute state threshold of each indicator type. Then, the current value of each indicator in the current state information is mathematically compared with the absolute state threshold range just obtained, thereby obtaining the first comparison result. The first comparison result records which indicators are within the normal range, which indicators exceed the range, and the specific circumstances of exceeding the range.

[0060] For example, the connection frequency per minute metric is set with an absolute state threshold of 0 to 100 times within a normal range. If the current connection frequency of a node in the current state information is 150 times, the first comparison result is obtained by comparing the value with the set normal range of 0 to 100 times.

[0061] S32: Based on the first comparison result, if at least one indicator value in the current state information exceeds the corresponding absolute state threshold, a first state evaluation result for an abnormal state is generated; otherwise, a first state evaluation result for a normal state is generated.

[0062] Specifically, the system checks whether any indicator in the first comparison result is marked as out of range, and whether there are any abnormal items. If at least one indicator value in the current status information exceeds the corresponding absolute status threshold, i.e., when the condition is met, a first status assessment result for an abnormal status is generated. This result records which indicator has exceeded the normal range. For example, the current value of 150 times has exceeded the normal range and meets the condition judgment. The first status assessment result for an abnormal status is an abnormal record indicating that there is an event with an excessively high connection frequency. Conversely, if all indicators are within the normal range, a first status assessment result for a normal status is generated.

[0063] In one embodiment, such as Figure 6 As shown, in step S40, based on the current state information and the previous state information, a second state evaluation is performed on the communication node to obtain the second state evaluation result of the communication node, specifically including: S41: By performing numerical calculations on the current state information and the previous state information for the corresponding indicator types, the state change difference of each indicator type is calculated.

[0064] Specifically, by subtracting the previous value of the same type of indicator from the previous state information from the current value of each indicator in the current state information, the resulting numerical value is the state change difference of each indicator type. This difference may be positive, indicating an increase in the indicator; negative, indicating a decrease in the indicator; or zero, indicating no change in the indicator. For example, if the previous state information of a node shows a connection frequency of 10 times per minute, while the current state information shows that the value has changed to 80 times, the state change difference is 70 by subtracting the previous value of 10 from the current value of 80. This difference accurately quantifies the increase in the node's connection behavior between the two analysis windows, providing a quantitative input for subsequent judgment of the severity of the behavior change.

[0065] S42: Compare the state change difference of each indicator type with the corresponding preset jump threshold to obtain the second comparison result.

[0066] Specifically, the preset jump threshold is a benchmark value used to measure the degree of change. It defines a maximum tolerable amount of change. For example, the connection frequency index is set to a jump threshold of 50 times per minute. By comparing the calculated state change difference value of 70 with this preset jump threshold value of 50, a second comparison result is obtained. The second comparison result clarifies that the change difference value of 70 has exceeded the maximum allowable change value of 50, and clearly records whether the change difference value of each index is within the tolerable jump threshold value.

[0067] S43: Based on the second comparison result, if the state change difference of at least one indicator type exceeds the corresponding preset jump threshold, a second state evaluation result of abnormal behavior mutation is generated; otherwise, a second state evaluation result of normal state change is generated.

[0068] Specifically, the system checks whether any indicator difference in the second comparison result is marked as exceeding the jump threshold. When the state change difference of at least one indicator type exceeds the corresponding preset jump threshold, i.e., when the condition is met, a second state assessment result of abnormal behavior mutation is generated. This structure records which indicator has undergone what kind of drastic change. For example, the second comparison result above shows that the difference 70 has exceeded the jump threshold 50, which satisfies the condition judgment. Therefore, a structured abnormal record indicating that there is an event with a sudden increase in connection frequency in a short period of time is generated, thus obtaining a second state assessment result of abnormal behavior mutation. Conversely, if the change difference of all indicators does not exceed the corresponding jump threshold, a second state assessment result of normal state change is generated.

[0069] In one embodiment, such as Figure 7As shown, in step S50, based on the first and second state evaluation results, a third state evaluation is performed on the communication node through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node, specifically including: S51: If the first state evaluation result is an abnormal state and / or the second state evaluation result is a behavioral mutation abnormality, then based on the first state evaluation result and the second state evaluation result, the corresponding behavioral label sequence is obtained by matching with the predefined behavioral label definition library.

[0070] Specifically, when at least one of the above evaluation results indicates an anomaly, i.e., the first state evaluation result is an abnormal state or the second state evaluation result is an abnormal behavior mutation, or both the first and second evaluation results are abnormal, behavior label matching is performed using a behavior label definition library. The behavior label definition library is a set of preset mapping rule dictionaries, whose function is to convert the evaluated abnormal events into unified behavior labels. For example, an event indicating excessively high connection frequency can be matched and converted into a high-frequency connection label. Then, by matching with the predefined behavior label definition library, one or more such time-ordered sets of labels generated by the communication node within the current analysis window are matched. This sequence will serve as the direct input for the next step of pattern matching.

[0071] S52: Based on the sequence analysis mechanism, the behavior label sequence is matched to obtain the matching result. According to the matching result, if there is a behavior label sequence that successfully matches the preset dangerous behavior combination pattern, a third state evaluation result of identifying the composite attack event is generated; otherwise, a third state evaluation result of not identifying the composite attack event is generated.

[0072] Specifically, the sequence analysis mechanism can be implemented as a finite state automaton (FSM), which pre-defines multiple dangerous behavior combination patterns. Each pattern is defined by a specific behavior label sequence. By taking the generated label sequence as input, the FSM state of the node is driven to change according to the pre-determined transition rules. If a behavior label sequence can be successfully matched with the pre-determined dangerous behavior combination pattern, the FSM state of the corresponding node enters a pre-determined dangerous termination state. At this time, a third-state evaluation result is generated, indicating that a compound attack event has been identified, which indicates that this is a high-risk conclusion. Conversely, if the label sequence fails to cause the FSM to enter any dangerous termination state, a third-state evaluation result is generated, indicating that no compound attack event has been identified.

[0073] S53: If the first state assessment result is normal and the second state assessment result is normal state change, then a third state assessment result is generated indicating that no composite attack event was identified.

[0074] Specifically, when none of the above assessment results indicate any anomalies, i.e., the first state assessment result is normal and the second state assessment result is normal state change, the above label generation and sequence matching steps are skipped. This is because, in the absence of anomalies, it is impossible to match any dangerous pattern composed of anomalies. Therefore, the third state assessment result is directly determined as no composite attack event has been identified, which improves the overall processing efficiency and ensures that analysis resources can be concentrated on processing communication nodes that actually exhibit abnormal behavior.

[0075] In one embodiment, such as Figure 8 As shown, in step S60, based on the first state evaluation result, the second state evaluation result, and the third state evaluation result, the network data packets corresponding to the communication node are transmitted accordingly, specifically including: S61: If the first state assessment result is an abnormal state and / or the second state assessment result is an abnormal behavior mutation and / or the third state assessment result is a composite attack event identified, then based on the preset risk handling strategy mapping table, risk handling operations are performed on the network data packets corresponding to the communication node. The risk handling operations include at least blocking the transmission of network data packets and limiting the transmission rate of network data packets.

[0076] Specifically, the preset risk handling strategy mapping table is a predefined set of rules that maps different types and severity levels of risk events, such as abnormal states, abnormal behaviors, and compound attack events, to specific control actions. Based on the highest risk level indicated in the assessment results obtained from the above steps, the corresponding risk handling operation is retrieved from the mapping table and performed. For example, for a node that detects a high-risk compound attack event, the corresponding handling operation is to block the transmission of network data packets, that is, to directly discard all its data packets. For a lower-risk state abnormality, the corresponding handling operation is to limit the transmission rate of network data packets, thereby achieving differentiated control over different threats.

[0077] S62: If the first state assessment result is normal, the second state assessment result is normal state change, and the third state assessment result is no composite attack event detected, then the network data packets corresponding to the communication node shall be forwarded normally to allow data transmission.

[0078] Specifically, when all three evaluation results of a communication node are confirmed to be normal (i.e., the first evaluation result is normal, the second evaluation result is normal state change, and the third evaluation result is no composite attack event detected), no additional security restrictions or control policies will be imposed on its data transmission. That is, the network data packets corresponding to the communication node will be quickly and indiscriminately transmitted to their predetermined destination according to standard network routing and forwarding protocols. This operation ensures that, under the premise of security, the communication experience of the vast majority of normal users is smooth and uninterrupted, thereby achieving a balance between security and performance.

[0079] In one embodiment, exemplarily, when an unfamiliar attacker IP such as 1.2.3.4 attempts to connect for the first time, to address the problem of rigidity in existing authentication mechanisms, the trust score-driven hierarchical authentication mechanism in this application, corresponding to steps S101-S102, first assigns a neutral initial trust score to the IP address and guides it through a standard encrypted authentication channel. After successful authentication, the attacker begins a slow port scan. This behavior is collected in step S20. Since this behavior is spread over a relatively long period, individual indicators such as connection frequency do not exceed the set absolute threshold. Therefore, the results of the first state evaluation (step S30) and the second state evaluation (step S40) are both normal; that is, the first state evaluation result is normal and the second state evaluation result is normal state change. Although the first two evaluations are normal, the sequence analysis mechanism in the third state evaluation (step S50), when analyzing its behavior, identifies and marks this scattered connection attempt behavior targeting multiple ports as a behavior label called port scanning. At this time, the internal FSM state of node 1.2.3.4 transitions from the initial state to the discovered scanning state. At this moment, since a complete attack chain has not yet been formed, the assessment result is still that no compound attack event has been identified, but a key contextual clue has been recorded.

[0080] However, in the subsequent analysis window, the attacker launched a concentrated login attempt targeting the open ports discovered by their scan. This caused a sharp jump in the number of failed authentication attempts within a short period of time. Although the absolute value may still be low, this sudden change was successfully captured by the second state assessment, i.e., step S40, and a result of abnormal behavior mutation was generated. The sequence analysis mechanism in step S50 received this new abnormal result and marked it as a sudden increase in authentication failures. At this time, the FSM engine of the sequence analysis mechanism found that node 1.2.3.4, which was in the discovered scanning state, received the label of sudden increase in authentication failures, which matched the preset dangerous behavior combination pattern called "scan-after-brute force". Therefore, the final assessment result of step S50, i.e., the third state assessment result, was determined to have identified a composite attack event. Subsequently, step S60, based on this high-risk result, performed a risk disposal operation to block the transmission of 1.2.3.4, completely blocking the attacker's IP. Through the collaborative work of multi-dimensional assessment, this application can accurately identify complex attacks with contextual relationships that are difficult to detect by traditional methods. It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0081] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores data such as network packets, current status information, preset authentication mechanisms, and preset risk handling strategy mapping tables. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a data transmission method based on a network gateway.

[0082] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Obtain network packets passing through the network gateway, and determine the analysis time window based on the network packets; Within the analysis time window, obtain the current status information of the communication nodes in the network, and obtain the previous status information of the communication nodes in the previous analysis time window. Based on the current state information, the communication node is evaluated in a first state according to the first preset benchmark, and the first state evaluation result of the communication node is obtained. Based on the current state information and the previous state information, a second state evaluation is performed on the communication node to obtain the second state evaluation result of the communication node; Based on the first and second state evaluation results, a third state evaluation is performed on the communication node through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node.

[0083] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Obtain network packets passing through the network gateway, and determine the analysis time window based on the network packets; Within the analysis time window, obtain the current status information of the communication nodes in the network, and obtain the previous status information of the communication nodes in the previous analysis time window. Based on the current state information, the communication node is evaluated in a first state according to the first preset benchmark, and the first state evaluation result of the communication node is obtained. Based on the current state information and the previous state information, a second state evaluation is performed on the communication node to obtain the second state evaluation result of the communication node; Based on the first and second state evaluation results, a third state evaluation is performed on the communication node through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node.

[0084] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0085] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0086] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A data transmission method based on a network gateway, characterized in that, The data transmission method based on the network gateway includes: Obtain network data packets passing through the network gateway, and determine the analysis time window based on the network data packets; Within the analysis time window, the current status information of the communication nodes in the network is obtained, and the previous status information of the communication nodes in the previous analysis time window is obtained. Based on the current state information, the communication node is evaluated according to a first preset benchmark to obtain the first state evaluation result of the communication node. Based on the current state information and the previous state information, a second state evaluation is performed on the communication node to obtain the second state evaluation result of the communication node; Based on the first state evaluation result and the second state evaluation result, the communication node is evaluated in a third state through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node. Based on the first state evaluation result, the second state evaluation result, and the third state evaluation result, the network data packets corresponding to the communication node are transmitted accordingly.

2. The data transmission method based on a network gateway according to claim 1, characterized in that, Prior to the step of determining the analysis time window based on the network data packets, the data transmission method based on a network gateway further includes: Based on the network data packets, the trust score of the communication node is obtained, and based on the trust score, the authentication level of the communication node is determined. Based on the authentication level of the communication node and a preset authentication mechanism, the communication node is authenticated to obtain the authentication result.

3. The data transmission method based on a network gateway according to claim 2, characterized in that, The step of authenticating the communication node based on its authentication level and a preset authentication mechanism to obtain an authentication result specifically includes: If the authentication level of the communication node is high trust level, then the fast authentication channel is invoked to authenticate the communication node. If the signature of the communication node is correct and the authentication is within the validity period, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated. If the authentication level of the communication node is the standard trust level, then the encrypted authentication channel is invoked to authenticate the communication node. If the random signature of the communication node is correct, an authentication result of successful authentication is generated; otherwise, an authentication result of failed authentication is generated. If the authentication level of the communication node is low trust level, then the enhanced challenge channel is invoked to authenticate the communication node, and the random signature of the communication node is determined to be correct. If the random signature of the communication node is correct, the data verification answer returned by the communication node is obtained. If the data verification answer is correct, the authentication result of passing is generated; otherwise, the authentication result of failing is generated. If the authentication level of the communication node is untrusted, then an authentication failure result is generated.

4. The data transmission method based on a network gateway according to claim 1, characterized in that, The determination of the analysis time window based on the network data packets specifically includes: Obtain global traffic statistics from the network data packets, wherein the global traffic statistics include at least the total data packet rate and the total connection rate; The global traffic statistics are matched with a preset traffic level analysis time mapping table to obtain the corresponding analysis time window duration. The analysis time window is then determined based on the analysis time window duration.

5. The data transmission method based on a network gateway according to claim 1, characterized in that, The step of performing a first state evaluation on the communication node based on the current state information and according to a first preset benchmark to obtain the first state evaluation result of the communication node specifically includes: Based on a first preset benchmark, the absolute state threshold of each indicator type is obtained, and the current state information is compared with the corresponding absolute state threshold according to the indicator type to obtain a first comparison result. Based on the first comparison result, if at least one indicator value in the current state information exceeds the corresponding absolute state threshold, a first state evaluation result of abnormal state is generated; otherwise, a first state evaluation result of normal state is generated.

6. The data transmission method based on a network gateway according to claim 5, characterized in that, The step of performing a second state evaluation on the communication node based on the current state information and the previous state information to obtain the second state evaluation result of the communication node specifically includes: By performing numerical calculations on the current state information and the previous state information for corresponding indicator types, the state change difference of each indicator type is calculated. The state change difference of each of the aforementioned indicator types is compared with the corresponding preset jump threshold to obtain a second comparison result; Based on the second comparison result, if the difference in state change for at least one indicator type exceeds the corresponding preset jump threshold, a second state evaluation result indicating abnormal behavior mutation is generated; otherwise, a second state evaluation result indicating normal state change is generated.

7. The data transmission method based on a network gateway according to claim 6, characterized in that, Based on the first and second state evaluation results, a third state evaluation is performed on the communication node through a preset sequence analysis mechanism to obtain the third state evaluation result of the communication node, specifically including: If the first state assessment result is an abnormal state and / or the second state assessment result is a behavioral mutation abnormality, then based on the first state assessment result and the second state assessment result, the corresponding behavioral label sequence is obtained by matching with a predefined behavioral label definition library; Based on the sequence analysis mechanism, the behavior tag sequence is matched to obtain a matching result. According to the matching result, if the behavior tag sequence successfully matches a preset dangerous behavior combination pattern, a third state evaluation result of identifying a composite attack event is generated; otherwise, a third state evaluation result of not identifying a composite attack event is generated. If the first state assessment result is "normal" and the second state assessment result is "normal state change", then a third state assessment result is generated indicating that no composite attack event was identified.

8. The data transmission method based on a network gateway according to claim 1, characterized in that, The step of transmitting network data packets corresponding to the communication node based on the first state evaluation result, the second state evaluation result, and the third state evaluation result specifically includes: If the first state assessment result is an abnormal state and / or the second state assessment result is an abnormal behavior mutation and / or the third state assessment result is the identification of a compound attack event, then based on the preset risk handling strategy mapping table, risk handling operations are performed on the network data packets corresponding to the communication node. The risk handling operations include at least blocking the transmission of the network data packets and limiting the transmission rate of the network data packets. If the first state assessment result is normal, the second state assessment result is normal state change, and the third state assessment result is no composite attack event detected, then the network data packets corresponding to the communication node will be forwarded normally to allow data transmission.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the data transmission method based on a network gateway as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of a data transmission method based on a network gateway as described in any one of claims 1 to 8.

Images