Traffic analysis audit backtracking method and device, computer device and storage medium

Abstract

The application belongs to the technical field of information processing, and relates to a traffic analysis audit backtracking method and device, computer equipment and a storage medium.The method comprises the following steps: collecting original network traffic data and processing the traffic data; performing multi-source data fusion and standardization on the processed traffic data; constructing an abnormal traffic feature library based on the fused and standardized multi-source data; constructing a threat traffic link graph based on the abnormal traffic feature library; profiling normal behaviors of users, devices and assets, constructing a normal traffic link graph, identifying deviated behaviors by comparing real-time traffic with normal traffic, and realizing abnormal detection; and positioning a security event root cause by multidimensional backtracking and intelligent association, and intelligently backtracking and analyzing.The unknown security risks deviating from the normal mode can be effectively identified, a leap from known threat detection to abnormal behavior identification is realized, and complex attack chains that cannot be found by a single security device can be accurately identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information processing, and in particular to a traffic analysis audit backtracking method and device, a computer device and a storage medium. BACKGROUND

[0002] With the deepening of enterprise digital transformation and the increasing complexity of network attacks, network security has shifted from traditional border protection to comprehensive defense centered on deep detection and rapid response. Network traffic, as the true carrier of network activity, contains the most comprehensive and direct security information. Therefore, analysis, audit and backtracking technology based on network traffic has become a key component of modern security systems.

[0003] Existing traffic analysis solutions have many technical bottlenecks and defects, mainly in the following aspects:

[0004] Serious security data island phenomenon: In traditional security systems, security devices such as firewalls, intrusion detection systems (IDS), and terminal protection systems usually operate independently, generating separate alarms and logs. These data lack effective correlation analysis, forming "information islands". Security analysts need to manually switch between different systems and correlate information, which is inefficient and prone to missing critical clues. For example, a successful attack may only leave low-level, isolated alarms in each system, making it impossible to automatically correlate and build a complete attack path, resulting in threats being overlooked.

[0005] Insufficient detection capability for unknown threats and stealth attacks: Existing detection technologies rely heavily on known attack feature libraries (such as virus signatures and rule libraries), and have poor detection results for unknown threats or advanced attacks that use encrypted traffic, exploit vulnerabilities, or low-frequency slow attacks. Lack of accurate modeling of normal network behavior baselines makes it difficult to detect abnormal operations initiated by attackers using legitimate credentials (such as data theft and lateral movement). SUMMARY

[0006] To solve the above technical problems, the present application provides a traffic analysis audit backtracking method, which adopts the following technical solutions, including the steps of:

[0007] Collecting raw network traffic data and processing the traffic data;

[0008] Performing multi-source data fusion and standardization on the processed traffic data;

[0009] Based on the multi-source data after fusion and standardization, an abnormal traffic feature library is constructed;

[0010] Based on the abnormal traffic feature library, a threat traffic link graph is constructed;

[0011] Portrait of normal behavior of users, devices, assets, construct normal traffic link graph, identify deviation behavior by comparing real-time traffic with normal traffic, realize anomaly detection;

[0012] Through multi-dimensional backtracking and intelligent association, locate the root cause of security events, and perform intelligent backtracking and analysis.

[0013] Preferably, the step of collecting raw network traffic data and processing the traffic data specifically comprises:

[0014] Collecting the raw network traffic data of the network node;

[0015] Traffic filtering and slicing of the raw network traffic data;

[0016] DPI deep packet analysis of the raw network traffic data after traffic filtering and slicing to identify application protocols and content.

[0017] Preferably, the step of multi-source data fusion and standardization of the processed traffic data specifically comprises:

[0018] Generating session data based on the processed traffic data;

[0019] Unified log format of different sources, log normalization;

[0020] Store standardized metadata.

[0021] Preferably, the step of constructing an abnormal traffic feature library based on the multi-source data after fusion and standardization specifically comprises:

[0022] Based on the multi-source data after fusion and standardization, locate the traffic segment related to the abnormal event;

[0023] Extract multi-dimensional features from traffic to form feature vectors for anomaly detection;

[0024] Standardize and classify features to form a reusable feature set for attack feature aggregation.

[0025] Preferably, the step of constructing a threat traffic link graph based on the abnormal traffic feature library specifically comprises:

[0026] Based on the abnormal traffic feature library, identify devices and assets in the network to provide vertices for graph construction;

[0027] Establish the association relationship between devices and assets to form the edges of the graph;

[0028] Associate threat events to the graph to visualize attack paths.

[0029] Preferably, the step of profiling normal behaviors of users, devices, assets, constructing normal traffic link graph, identifying deviated behaviors by comparing real-time traffic with normal traffic, and realizing anomaly detection specifically comprises:

[0030] Extracting complete link data of user business process, including user normal business traffic link and baseline characteristics;

[0031] Using vertices to represent users, devices, assets, using directed edges to represent request and response operations, and adding baseline characteristics and serial number attributes to vertices and directed edges, constructing a normal traffic link graph for anomaly detection.

[0032] Preferably, the step of locating the root cause of the security event through multidimensional backtracking and intelligent association, and performing intelligent backtracking and analysis specifically comprises:

[0033] Storing multidimensional aggregated data and constructing a backtracking database;

[0034] Setting multidimensional viewing application list, session list and message details through a GUI interface, and performing interactive backtracking;

[0035] Automatically associating alarms with traffic data and performing intelligent backtracking.

[0036] To solve the above technical problems, the present application further provides a traffic analysis audit backtracking device, which adopts the following technical scheme, comprising:

[0037] A processing module for collecting raw network traffic data and processing the traffic data;

[0038] A fusion module for performing multi-source data fusion and standardization on the processed traffic data;

[0039] A feature module for constructing an abnormal traffic feature library based on the multi-source data after fusion and standardization;

[0040] A threat traffic link module for constructing a threat traffic link graph based on the abnormal traffic feature library;

[0041] A normal traffic link module for profiling normal behaviors of users, devices, assets, identifying deviated behaviors by comparing real-time traffic with normal baseline, realizing anomaly detection, and constructing a normal traffic link graph;

[0042] An analysis module for locating the root cause of the security event through multidimensional backtracking and intelligent association, and performing intelligent backtracking and analysis.

[0043] To solve the above technical problems, the present application also provides a computer device, which adopts the technical scheme as follows, comprising a memory and a processor, the memory stores computer readable instructions, and the processor executes the computer readable instructions to realize the steps of the traffic analysis audit backtracking method.

[0044] To solve the above technical problems, the present application also provides a computer readable storage medium, which adopts the technical scheme as follows, the computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by the processor to realize the steps of the traffic analysis audit backtracking method.

[0045] Compared with the prior art, the present application has the following beneficial effects:

[0046] The normal traffic link graph is established, and the normal behavior of users, devices and assets is associated and profiled. By comparing real-time traffic with the normal traffic link graph, unknown security risks deviating from the normal mode are effectively identified, and the detection of known threats and the identification of abnormal behavior are realized.

[0047] By constructing the threat traffic link graph and the normal traffic link graph, isolated threat indicators are associated into a visual attack scenario, realizing cross-device and cross-level collaborative perception and correlation analysis, so as to accurately identify complex attack chains that cannot be found by a single security device. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the schemes in the present application, the following will briefly introduce the drawings needed in the description of the embodiments of the present application. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0049] Figure 1 is a flow chart of an embodiment of the traffic analysis audit backtracking method of the present application;

[0050] Figure 2 is a schematic diagram of a threat traffic link graph used in the traffic analysis audit backtracking method of the present application;

[0051] Figure 3 is a schematic diagram of a connection of device vertices, asset vertices and threat vertices used in the traffic analysis audit backtracking method of the present application;

[0052] Figure 4 is a schematic diagram of a normal traffic link graph used in the traffic analysis audit backtracking method of the present application;

[0053] Figure 5is a backtracking analysis schematic diagram used in the flow analysis audit backtracking method of the present application;

[0054] Figure 6 is a structural schematic diagram of one embodiment of the flow analysis audit backtracking device of the present application;

[0055] Figure 7 is a structural schematic diagram of another embodiment of the flow analysis audit backtracking device of the present application;

[0056] Figure 8 is a structural schematic diagram of one embodiment of the computer device of the present application. DETAILED DESCRIPTION

[0057] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application; the description and claims of this application as well as the above abstract are intended to cover all alternatives, modifications, equivalents and equivalents thereof falling within the scope of the present application; the terms "comprise", "comprising", "include", "including", "have" and "having" as used herein are intended to be construed as specifying the presence of the stated features, steps or components, but not precluding the presence or addition of one or more other features, steps, components or groups thereof. The terms "first", "second", "third", etc. as used herein are used for distinguishing between similar objects having different properties, and not for describing a particular sequential order.

[0058] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another.

[0059] For better understanding of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings.

[0060] It should be noted that the flow analysis audit backtracking method provided by the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the flow analysis audit backtracking device is generally arranged in the server / terminal device.

[0061] It should be understood that the number of terminal devices, networks and servers is only illustrative. Any number of terminal devices, networks and servers can be provided according to the implementation needs.

[0062] Embodiment one

[0063] Please refer to Figure 1FIG. 1 shows a flow chart of one embodiment of the traffic analysis audit backtracking method of the present application. The traffic analysis audit backtracking method comprises the following steps:

[0064] In step S1, raw network traffic data is collected and processed.

[0065] In this embodiment, the electronic device (e.g. server / terminal device) on which the traffic analysis audit backtracking method runs can receive a traffic analysis audit backtracking request through wired or wireless connection. It should be noted that the wireless connection can include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAXX connection, Zigbee connection, UWB (ultra wideband) connection, and other now known or future developed wireless connection methods.

[0066] In this embodiment, step S1 of collecting raw network traffic data and processing the traffic data can specifically include the following steps:

[0067] S11, collecting the raw network traffic data of the network node.

[0068] Port mirroring, optical splitters or flow splitters are used to mirror traffic to collection probes on network devices (such as core switches, Internet exits). Probes support gigabit and above line speed processing, and high throughput packet capture is achieved through hardware acceleration technology (such as DPDK (Data Plane Development Kit) or FPGA (Field Programmable Gate Array)). DPDK reduces kernel overhead and improves packet processing efficiency through user space driver and polling mode; FPGA achieves low latency traffic forwarding through parallel processing capability.

[0069] For example, distributed collection probes are deployed at the entrance of the data center to mirror traffic through optical splitters, ensuring that the business is not affected.

[0070] The collected raw network traffic data includes complete probe data, session data, log data, and abnormal event and alarm data.

[0071] Complete probe data refers to packet capture data, which is the most complete and comprehensive representation of collectable network data.

[0072] Session data is not as detailed and complete as packet capture data, but its small size allows it to be saved for a long time, which is very valuable for security analysis. The most common session data is the standard five-tuple data, which is usually composed of five attributes: source IP, destination IP, source port, destination port, and transmission protocol. In addition to the five-tuple information, the start and end time of the transmission of the session, the duration, the source MAC, the destination MAC, the number of uplink and downlink packets and bytes, and the total number of packets of the session can also be included. Session information also records the physical interface information from which the session was collected, which can intuitively reflect the physical network location to which the session belongs in combination with the system network topology. All session data can be associated with the original data packets, and the original data packets of the session can be directly obtained according to the session data.

[0073] Log data is one of the most important and valuable data types, especially when it is stored in a secure central location and multiple log sources are associated. Log data records events, system / environmental status, and its sources are numerous, and it is generated by devices, systems, or application programs. Raw log files, including proxy logs, authentication logs, security logs, and SYSLOG data, etc. According to the source of the log, the log can be divided into physical device logs, network device logs, operating system logs, and application program logs.

[0074] Abnormal event and alarm data, when the value of some quantity in the detection system exceeds the specified limit, or any configured check data is abnormal, the system automatically generates abnormal event and warning information.

[0075] The function of step S11 is to obtain the traffic data of the key nodes of the network without loss, ensure the integrity of the data, and provide the original input for subsequent analysis.

[0076] S12, filtering and slicing the original network traffic data.

[0077] Filter the traffic according to the predefined policy (such as IP segment, protocol type). For example, only collect the traffic of the specified subnet (such as 192.168.1.0 / 24).

[0078] Packet slicing technology: only store the packet header and part of the payload (such as the first 64 bytes), but keep the complete payload for suspicious traffic (such as matching abnormal features). The slicing ratio can be configured, for example, to keep 20% of the payload content to save storage space.

[0079] Use a hash algorithm (such as MD5 or SHA-256) to generate a unique identifier for the sliced packet, which is convenient for subsequent association query.

[0080] The step S12 can reduce storage pressure, focus on key traffic data, and balance storage and analysis requirements.

[0081] S13, performing DPI deep packet analysis on the original network traffic data filtered and sliced, to identify application protocols and content.

[0082] Single packet fingerprint matching: identifying protocols through feature libraries (such as regular expression matching HTTP User-Agent field) and payload length analysis (such as detecting DNS query packet length anomalies).

[0083] Multi-packet association matching: analyzing the association rules between multiple messages of the same data stream, such as TCP handshake sequence or video stream fragmentation characteristics.

[0084] Supporting identification of traditional protocols (HTTP / FTP) and Internet applications (such as WeChat, BitTorrent). For example, identifying P2P traffic through characteristic strings (such as “BitTorrent”) in the payload.

[0085] The step S13 can accurately identify application protocols and content, providing a basis for behavior analysis.

[0086] Step S1 aims to obtain original network traffic data losslessly and efficiently, and to perform preliminary processing and storage, providing a high-quality data source for subsequent analysis. Through deep packet inspection (DPI), application protocols and content are identified to ensure the comprehensiveness and analyzability of the data.

[0087] Step S2, performing multi-source data fusion and standardization on the processed traffic data.

[0088] In this embodiment, step S2, performing multi-source data fusion and standardization on the processed traffic data, can specifically include the steps of:

[0089] S21, generating session data based on the processed traffic data.

[0090] Extracting the standard five-tuple (source IP, destination IP, source port, destination port, transmission protocol), and extending MAC address, start and end time, packet number, byte number, and other metadata.

[0091] Using flow recombination algorithms (such as message sorting based on TCP sequence numbers) to construct sessions, and assigning a unique ID to each session. For example, storing session data in Parquet columnar format to improve query performance.

[0092] The step S21 can recombine original data packets into session data, providing an abstract view of network communication, and facilitating macroscopic analysis.

[0093] S22, normalize log formats from different sources.

[0094] Parse logs from firewalls, IDS, servers, etc., extract key fields (timestamp, event type, source IP), and convert to a unified JSON format.

[0095] Use parsing templates (such as Grok expressions) to process heterogeneous logs. For example, map the "%ASA-6-302013" event in Cisco ASA firewall logs to the JSON field {"event_type": "connection_established", "src_ip": "192.168.1.10"}.

[0096] The function of step S22 is to unify the log formats from different sources and realize cross-device data correlation.

[0097] S23, store standardized metadata.

[0098] Use big data platforms (such as Hadoop HDFS or Elasticsearch) to store session data and normalized logs. Compress the complete packet data (PCAP) and store it in low-cost object storage (such as AWS S3).

[0099] Associate metadata with PCAP data through session ID. For example, create an inverted index in Elasticsearch to achieve millisecond-level retrieval.

[0100] The function of step S23 is to store standardized data and support efficient query and correlation analysis.

[0101] Step S2 converts heterogeneous data (such as session data, log data) into a unified format, eliminates information silos, realizes data correlation and fast retrieval. Through standardization, the efficiency and accuracy of subsequent analysis are improved.

[0102] Step S3, based on the fused and standardized multi-source data, constructs an abnormal traffic feature library.

[0103] In this embodiment, step S3, based on the fused and standardized multi-source data, constructs an abnormal traffic feature library, which can include the following steps:

[0104] S31, based on the fused and standardized multi-source data, locate the traffic segment related to the abnormal event.

[0105] Extract relevant traffic segments from massive traffic using key information such as timestamps, source IP, destination IP, etc. of abnormal events. For example, for a vulnerability scan alert, backtrack all sessions of the scan source IP within an hour before and after the alert.

[0106] Use time window queries (such as SQL BETWEEN statements) and IP matching algorithms to quickly locate data.

[0107] Step S31 is to locate traffic segments related to abnormal events, providing a data basis for feature extraction.

[0108] S32, extract multi-dimensional features from traffic, form feature vectors, and use them for anomaly detection.

[0109] Traffic layer features: Calculate connection frequency and traffic size per unit time. For example, use a counter and sliding window algorithm to count connections per second.

[0110] Protocol behavior features: Detect abnormal combinations of TCP flag bits (such as SYN-FLOOD attacks) or abnormal DNS query patterns (such as high-frequency random subdomain names).

[0111] Payload content features: Use entropy to detect encrypted or obfuscated traffic. The entropy formula is as follows:

[0112] , where: : Entropy of the payload, measures randomness; : Byte value Probability of occurrence in the payload; : Byte value range (0-255).

[0113] The higher the entropy value (close to 8), the more likely it is encrypted traffic; normal text traffic has a lower entropy value (about 4-5). This formula helps identify encrypted data leaks or malware communications.

[0114] Timing behavior features: Use time series analysis (such as ARIMA model) to detect scanning or blasting behavior.

[0115] S33, standardize and classify features to form reusable feature sets and aggregate attack features.

[0116] Use machine learning clustering algorithms (such as K-means) to group feature vectors to form attack scenario feature sets (such as "data leakage" or "C&C communication").

[0117] Feature standardization uses Z-score normalization: , where: : Normalized feature value; : Original feature value; : Feature mean value; : Feature standard deviation.

[0118] The influence of feature dimension can be eliminated, and the convergence speed and accuracy of the model can be improved.

[0119] Step S3 builds an intelligent feature library by extracting and aggregating multi-dimensional features, realizes the leap from "known threat detection" to "abnormal behavior identification", and the feature library is used to drive real-time detection and offline analysis, and improve unknown threat discovery capability.

[0120] Step S4, based on the abnormal traffic feature library, constructs a threat traffic link graph.

[0121] In this embodiment, step S4, based on the abnormal traffic feature library, constructing a threat traffic link graph can include the following steps:

[0122] S41, based on the abnormal traffic feature library, identifying devices and assets in the network to provide vertices for graph construction.

[0123] Use active scanning tools (such as Nmap) to discover devices and obtain device attributes (OS, open ports) through SNMP protocol.

[0124] Import business asset list (such as Web service, database) from CMDB, and assign a unique ID (such as UUID) to each node.

[0125] Node discovery and identification: including device nodes, discovering all network devices, servers, PCs, IoT devices, etc. through active scanning (Nmap), network management protocol (SNMP), terminal agent, etc. and assigning a unique ID to each device and attaching attributes (IP / MAC address, operating system, open port). Asset nodes, obtain business asset list such as Web service, database, key business application from CMDB (configuration management database), application system, and assign a unique ID to each asset and attach attributes (asset owner, business value, application belonging).

[0126] Using step S41, node discovery and identification can be performed.

[0127] S42, establish the association between devices and assets, form the edge of the graph.

[0128] Based on session data to mine communication relationship (such as traffic between IP pairs); based on log data to mine access relationship (such as user login record); use graph database (such as Neo4j) to store relationship, edge attributes include communication frequency, data volume, etc.

[0129] The device and the asset are taken as nodes of the association graph, and the association relationship between the devices, between the assets, and between the device and the asset is taken as an edge of the node, so as to construct the device-asset association graph.

[0130] S43, the threat event is associated into the graph, and the attack path is visualized.

[0131] The abnormal event, the alarm and the like are taken as threat vertices and are inserted into the graph, and the threat flow link graph is constructed according to the connection of the IP and the device / asset node.

[0132] The attack propagation path is analyzed by using a graph traversal algorithm (such as BFS). For example, the intranet horizontal movement can be identified by the node degree centrality.

[0133] Figure 2 is a threat flow link graph schematic diagram used in the flow analysis audit backtracking method of the application; Figure 3 is a connection schematic diagram of device vertices, asset vertices and threat vertices used in the flow analysis audit backtracking method of the application. As shown in Figure 2 and Figure 3 The vertices of the graph include threat vertex A, threat vertex B and threat vertex C, and the nodes (device vertices and asset vertices) of the graph include a server, a database, a PC terminal, a network device, a Web service, an API service and a business application. The device vertices, the asset vertices and the threat vertices can be multiple, and the specific number is determined according to the actual working scene.

[0134] The function of step S4 is to associate the isolated threat event into a visual attack scene, realize the cross-device and cross-level collaborative perception, and accurately identify the complex attack chain.

[0135] In step S5, the normal behavior of the user, the device and the asset is profiled, the normal flow link graph is constructed, the deviation behavior is identified by comparing the real-time flow with the normal flow, and the abnormal detection is realized.

[0136] In the embodiment, in step S5, the normal behavior of the user, the device and the asset is profiled, the normal flow link graph is constructed, the deviation behavior is identified by comparing the real-time flow with the normal flow, and the abnormal detection is realized. Specifically, the step can include the following steps:

[0137] S51, complete link data of a user business process is extracted.

[0138] Based on the historical normal flow, a request-response link (such as user login→access API→download file) is extracted.

[0139] Based on historical normal multi-source traffic data from the system, complete and ordered request-response traffic links and baseline features representing normal user business processes are extracted. Normal user business traffic links include the traffic data of the entire process from a user's request passing through various levels of node assets / devices to the target asset / device, and then the response returning to the user from the target asset / device through various levels of node assets / devices. Baseline features include user dimensions: frequently used login devices, frequently used login locations (IP ranges), active time periods, etc. Performance dimensions: time consumption and data volume for executing a certain type of operation, etc. Frequency dimensions: the normal frequency range for executing a certain type of operation within a specific time period. Baselines are calculated using statistical methods, such as frequency baselines. ,in: : Historical average operation frequency; Standard deviation.

[0140] Use pipelined processing frameworks (such as Apache Flink) to aggregate link data in real time.

[0141] S52 uses vertices to represent users, devices, and assets, and directed edges to represent request and response operations. It adds baseline features and sequence number attributes to vertices and directed edges to construct a normal traffic link graph for anomaly detection.

[0142] Using users, devices, and assets as vertices, directed edges are created between vertices based on the normal user business traffic flow, including: request edges (direction: initiator → processor) and response edges (direction: generator → initiator). A sequence number attribute is added to the edges to identify the order of the operation they represent in the user business traffic flow.

[0143] Figure 4 This is a schematic diagram of the normal traffic flow path used in the traffic analysis audit backtracking method of this invention. Figure 4 As shown, the vertices include user vertices, device vertices, and asset vertices. The first directed edge has request operations from edge E1, edge E2, edge E5, edge E6, and edge E7. The second directed edge has response operations from edge E3, edge E4, edge E8, edge E9, and edge E10.

[0144] User vertices can have attributes such as user-dimensional baseline features added. Business process-dimensional baseline features and behavior frequency-dimensional baseline features can be added to each directed edge. Request edges can also have attributes such as unique identifier, request type (GET, POST, QUERY, EXECUTE, etc.), request time, request parameters, source port, and destination port added. Response edges have attributes such as unique identifier (matching the corresponding request edge), response status (SUCCESS, ERROR, DENIED, etc.), response time, returned data volume, and response time taken.

[0145] Step S6, locate the root cause of the security event through multi-dimensional backtracking and intelligent association, and perform intelligent backtracking and analysis.

[0146] In this embodiment, step S6, locating the root cause of the security event through multi-dimensional backtracking and intelligent association, and performing intelligent backtracking and analysis can specifically include the following steps:

[0147] S61, store multi-dimensional aggregated data and build a backtracking database.

[0148] Use a columnar database (such as ClickHouse) to store metadata aggregated by dimensions such as physical address, IP address, and application type. Build a B+ tree index to optimize range queries (such as time interval retrieval).

[0149] When collecting and processing data, classify and aggregate multiple data tables through multiple dimensions and store them in the backtracking database. Multiple dimensions can be used as the first layer of selection range for backtracking, including physical address, IP address, application, network segment, and region. For example, select IP address, enter the application list, select the specified application of interest, enter the session list, select the specified session, and open the data packet to perform layer-by-layer backtracking analysis through the specified IP address, application of interest, session, and data packet.

[0150] The function of step S61 is to support fast query.

[0151] S62, set up a GUI interface to view application list, session list, and message details through multiple dimensions, and perform interactive backtracking.

[0152] Provide a GUI interface, and the user first selects a dimension (such as IP address), and then views the application list, session list, and message details layer by layer.

[0153] Use Web technology (such as React) to realize dynamic filtering and visualization.

[0154] Layer-by-layer drilling investigation can be performed. The first layer: selecting a dimension. For example, a network segment (192.168.1.0 / 24) is suspected to have an anomaly, the dimension of the network segment is selected first, and the network segment is input. The second layer: an application list. The system displays all application types (such as HTTP, MySQL, WeChat) found in the network segment, and the traffic statistics are attached. For example, unknown P2P application traffic is found to surge, and the application is selected. The third layer: a session list. The system lists all session data related to the network segment and the P2P application, and is sorted according to time, traffic size, etc. The detailed information (five-tuple, time, data volume) of each session can be viewed. The fourth layer: packet details. The system directly loads the original data packets of the suspicious session from the PCAP repository through the associated information recorded in the metadata, and performs deep packet analysis to view the clear text transmission content or perform payload feature comparison.

[0155] The step S62 has the effect that the user can perform layer-by-layer drilling investigation, and analyze the traffic from a macroscopic view to a microscopic view.

[0156] The step S63 has the effect that the alarm and the traffic data are automatically associated, and intelligent backtracking is performed.

[0157] In cooperation with the analysis and audit module, when the user clicks the alarm, the alarm information (timestamp, IP) is automatically used as a query condition to load the related sessions and packets from the backtracking database.

[0158] The correlation algorithm (such as hash connection based on session ID) is used to quickly locate the data.

[0159] The step S63 has the effect that the investigation efficiency is improved by automatically associating the alarm and the traffic data.

[0160] The step S6 has the effect that the powerful investigation and evidence collection capability is provided, the security event root is quickly located through multi-dimensional backtracking and intelligent association, and the response efficiency is improved.

[0161] Figure 5 The figure is a backtracking analysis schematic used in the traffic analysis and audit backtracking method of the application. As shown in the figure, Figure 5 When collection and data processing are performed, classification and aggregation are performed through multiple dimensions, and multiple data tables are aggregated and stored in the backtracking database. Multiple dimensions can be used as the first selection range for backtracking, and the multiple dimensions include physical addresses, IP addresses, applications, network segments, and regions. For example, the IP address is selected, the application list is entered, the specified application of interest is selected, the session list is entered, the specified session is selected, and the data packet is opened, so that the IP address, the application of interest, the specified session, and the data packet are used for layer-by-layer backtracking analysis.

[0162] The embodiment is implemented, and the beneficial effects are:

[0163] The normal traffic link graph is established, and the normal behaviors of users, devices and assets are associated and profiled, unknown security risks deviating from the normal mode are effectively identified through comparison between real-time traffic and the normal traffic link graph, and the cross from known threat detection to abnormal behavior identification is realized;

[0164] By constructing the threat traffic link graph and the normal traffic link graph, isolated threat indicators are associated into a visual attack scene, cross-device and cross-level collaborative perception and correlation analysis are realized, and complex attack chains that cannot be found by a single security device are accurately identified.

[0165] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0166] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by computer-readable instructions instructing related hardware, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0167] It should be understood that although each step in the flowchart of the accompanying drawings is shown in sequential order following the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise explicitly stated herein, there is no strict order requirement for the execution of these steps, which can be executed in other orders. Moreover, at least some of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of which is not necessarily sequential, but can be alternately or alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0168] Embodiment two

[0169] A traffic analysis audit backtracking method, comprising the following steps:

[0170] (1) Traffic collection and processing:

[0171] 1) Triggering an abnormal alarm: The system has preset an alarm strategy based on a threshold. When it is detected that the uplink data volume of a single session from an internal IP to a non-business approved external domain name (such as a personal network disk) exceeds 100 MB, an abnormal alarm event of "suspected data leakage" is immediately generated. The alarm information includes: timestamp, source IP (employee A's computer IP), destination IP (personal network disk server), destination domain name, uplink data volume (150 MB), protocol (TLS).

[0172] 2) Multi-dimensional abnormal feature extraction and matching: After the system receives this alarm, it automatically extracts all network sessions and traffic loads of employee A IP within one hour before and after the alarm as a clue. The traffic layer features are extracted: employee A's uplink traffic to external addresses accounts for 99% of his total uplink traffic in this time period, far exceeding his historical baseline (usually <1 MB). Protocol behavior features: HTTPS connection is initiated at non-working hours (8 pm), and the SNI field of the connection is a personal application, which is inconsistent with his daily work behavior (mainly accessing internal CRM and company-approved cloud services). Load content features: Although the load is encrypted, the system calculates the entropy value of the load and finds that it is consistent with the characteristics of encrypted / compressed files, rather than normal web browsing traffic. Timing behavior features: this behavior is identified as a typical feature of "small batch data leakage" - in a short period of time, a much higher data volume than the daily level is transmitted to external addresses.

[0173] 3) Attack feature aggregation and confirmation: The above-mentioned feature vector (large traffic, unusual domain name, non-working hours, high entropy value load) matches the model under the "data leakage" category in the abnormal traffic feature library. The system raises the risk level of this event to "high".

[0174] (2) Behavior identification:

[0175] Normal user behavior is convergent, unified and unchanging, while the behavior of attackers is some rare behaviors, such as executing commands, requesting a large amount of data, downloading sensitive files, at this time we can monitor a request into the container to the response out, what behavior is in the middle, and then according to the normal traffic link diagram to identify attack behavior.

[0176] 1) Structural anomaly: Check whether the traffic of a session or transaction can find a complete and coherent path in the normal traffic link diagram. Embodiment: A user session passes the authentication (matches the edge of [user]->[authentication gateway]), but there is no subsequent access to any business API (the edge of [authentication gateway]->[business API] is missing), and instead attempts to access [operation and maintenance interface]. The edge of [authentication gateway] to [operation and maintenance interface] does not exist in the normal graph. Conclusion: This session is structurally abnormal, identifying the risk of abuse of authority or internal threats.

[0177] 2) Attribute anomaly: Although the traffic path matches the normal graph, the value or distribution of the key attribute on the edge exceeds the historical baseline. Embodiment: A [user]->[file service] "download" edge, whose download_size attribute has a baseline of 1-10MB in the normal graph. The value of this attribute in the current session is 500MB. The user's normal traffic link diagram has never downloaded such a large file (user historical baseline deviation), and the download occurs outside of working hours (time attribute deviation). Conclusion: The coordinated deviation of multiple attributes identifies data leakage behavior.

[0178] 3) Timing and frequency anomaly: Analyze whether the triggering order and frequency of edges between vertices violate the business logic defined by the normal graph. Embodiment: The normal order business process is: [login]->[browse goods]->[add to cart]->[payment]. But a link is detected: [login]->[directly access payment API]. The system finds that this payment request lacks the "browse" and "add to cart" behaviors in front of the normal traffic link diagram, and the call frequency of the payment API is extremely high in a short period of time. Conclusion: This behavior sequence is abnormal, identifying "API abuse" or "credential stuffing attack".

[0179] (3) Association analysis:

[0180] In the usual protection system, there are usually information silos, and the data of each dimension is not associated with each other. Collecting data from each dimension, each device, and each layer based on normal traffic link diagrams and threat traffic link diagrams for association analysis to achieve malicious behavior identification.

[0181] The low confidence abnormal behavior signal compared by the threat traffic link graph acquisition engine and the normal traffic link graph acquisition engine is acquired, and through space-time correlation analysis, whether the two signals point to the same session or associated entity is verified; when it is confirmed that they are the same target, the risk level is raised and traceability analysis is started, and a complete attack chain is reconstructed.

[0182] The threat graph detects that a host [PC-A] in the internal network performs a DNS query on a domain name, which is "low reputation" (not explicitly malicious, but suspicious) in threat intelligence. The normal graph monitors that another server [SVR-B] initiates a [file reading] request to the file server, and the data volume is 2% more than usual (slightly deviates from the baseline).

[0183] 1) Cooperative correlation: through space-time analysis, it is found that the user of [PC-A] also has an account on [SVR-B], and the two events occur at similar times. Further, the historical behavior of [SVR-B] is traced back in the normal graph, and it is found that there is a very slow but continuous data growth trend in recent days. In the threat graph, [PC-A] is traced back, and it is found that it has multiple behaviors of connecting to unusual ports in recent days.

[0184] 2) Attack chain restoration: by correlating multiple "weak signals" from different graphs, the system pieces together a complete attack chain: the attacker controls [PC-A] as a stepping stone, slowly steals data from [SVR-B], and transmits it out through [PC-A]. The system generates a "serious" alarm, indicating that a "potential APT data leakage activity" is found, and a complete attack link visualization graph is attached.

[0185] The embodiment is implemented, and has the beneficial effects that:

[0186] A normal traffic link graph is established, and the normal behavior of users, devices and assets is associated and profiled. By comparing real-time traffic with the normal traffic link graph, unknown security risks deviating from the normal mode are effectively identified, and a leap from known threat detection to abnormal behavior identification is achieved;

[0187] By constructing a threat traffic link graph and a normal traffic link graph, isolated threat indicators are associated into a visual attack scenario, cooperative perception and correlation analysis across devices and layers are achieved, and complex attack chains that cannot be discovered by a single security device are accurately identified.

[0188] Embodiment three

[0189] Further reference Figure 6 , as an implementation of the method shown in Figure 1 , the present application provides an embodiment of a traffic analysis audit backtracking device, which corresponds to the method embodiment shown in Figure 1 , and the device can be applied in various electronic devices.

[0190] As Figure 6 shown, the traffic analysis audit backtracking device 70 of the embodiment includes a processing module 71, a fusion module 72, a feature module 73, a threat traffic link module 74, a normal traffic link module 75, and an analysis module 76. Among them:

[0191] The processing module 71 is configured to collect raw network traffic data and process the traffic data;

[0192] The fusion module 72 is configured to perform multi-source data fusion and standardization on the processed traffic data;

[0193] The feature module 73 is configured to construct an abnormal traffic feature library based on the multi-source data after fusion and standardization;

[0194] The threat traffic link module 74 is configured to construct a threat traffic link graph based on the abnormal traffic feature library;

[0195] The normal traffic link module 75 is configured to profile the normal behavior of users, devices, and assets, construct a normal traffic link graph, and identify deviating behavior by comparing real-time traffic with normal traffic, thereby achieving anomaly detection;

[0196] The analysis module 76 is configured to locate the root cause of security events through multi-dimensional backtracking and intelligent association, and perform intelligent backtracking and analysis.

[0197] The embodiment has the following beneficial effects:

[0198] A normal traffic link graph is established to associate and profile the normal behavior of users, devices, and assets. By comparing real-time traffic with the normal traffic link graph, unknown security risks deviating from the normal mode are effectively identified, and a leap from known threat detection to abnormal behavior recognition is achieved;

[0199] By constructing a threat traffic link graph and a normal traffic link graph, isolated threat indicators are associated into visual attack scenarios, realizing cross-device and cross-layer collaborative perception and association analysis, and thus accurately identifying complex attack chains that cannot be discovered by a single security device.

[0200] Embodiment Four

[0201] Further referring to Figure 7 , as an implementation of the method shown in the above Figure 1 , the present application provides another embodiment of a traffic analysis audit backtracking device, which corresponds to the method embodiment shown in Figure 1 . The device can be applied to various electronic devices.

[0202] As Figure 7As shown, the traffic analysis audit backtracking device described in the embodiment includes a distributed collection layer, a traffic analysis audit layer, and a traffic backtracking layer. The distributed collection layer further includes a collection probe cluster, an external log source firewall / terminal, and a parallel computing platform. The traffic analysis audit layer includes a metadata storage big data platform, a big data analysis platform, a core analysis engine, and an audit and reporting unit. The core analysis engine further includes an abnormal traffic feature library, a threat traffic link graph, and a normal traffic link graph.

[0203] The distributed collection layer is the basis of the device of the embodiment, and the goal is to achieve unified access and processing of full traffic and multiple data sources.

[0204] The collection probe cluster is deployed at network key nodes (such as Internet exit, core switching area, data center entrance) to deploy distributed collection probes. The collection method is to use port mirroring, optical splitter / divider, etc. to mirror the traffic to the collection port of the probe without loss. The processing capacity: the probe needs to have a gigabit or above line speed processing capacity, and supports hardware acceleration (such as DPDK, FPGA) to cope with high throughput.

[0205] The parallel computing platform integrates data processing and storage engines, and filters traffic according to strategies (such as specified IP segment, protocol). To balance the storage and analysis needs, the message can be sliced, only storing the message header and part of the payload, but retaining the complete payload for suspicious traffic. It also integrates a DPI deep packet analysis engine that can perform single packet fingerprint matching (feature library matching, payload length analysis) and multi-packet association matching, with a recognition range covering protocols (HTTP / S, FTP, SMTP, DNS) and applications.

[0206] In addition, data standardization and association can also be performed, involving session data generation, log normalization, and metadata storage.

[0207] Session data generation: recombines the original data packets passing through the probe into session data, including the standard five-tuple, and extends MAC address, start and end time, packet number / byte number, application protocol label, physical interface information, etc.

[0208] Log normalization: accesses log data from firewalls, IDS / IPS, terminals, servers, middleware, etc., parses and normalizes it into a unified JSON format, and extracts key fields (timestamp, event type, source / destination IP, user, etc.).

[0209] Metadata storage: stores session data and normalized log data as metadata into a big data platform for fast retrieval and analysis. Complete message data (PCAP) is compressed and stored in a low-cost object storage or a dedicated PCAP storage library, and is associated with metadata through the session ID.

[0210] The traffic analysis audit layer is the brain of the device, based on big data technology, using the constructed various feature library and atlas, intelligent analysis is carried out.

[0211] The big data analysis platform uses Hadoop / Spark or stream processing platform (such as Flink) as a computing engine to support batch computing and real-time stream computing of massive data.

[0212] The core analysis component - abnormal traffic feature library, import historical abnormal events and alarm data and its corresponding traffic segment. Four-dimensional features (traffic layer, protocol behavior, load content, timing behavior) are extracted from these traffic. Machine learning (such as clustering algorithm) is used to aggregate and standardize the features to form feature rule sets or detection models for different attack scenarios (such as "brute force", "C2 communication", "data leakage") and store them in the feature library.

[0213] The feature library is used to drive real-time detection engine and offline analysis task to continuously discover new threats. It supports threshold and baseline-based traffic alarm strategy and provides sensitive domain name, combined feature value and other alarm methods.

[0214] The core analysis component - threat traffic link graph engine first constructs a device-asset atlas. Nodes: through active scanning, passive listening and CMDB import, a node library containing devices (IP, MAC, OS) and business assets (Web service, database) is constructed. Edges: based on long-term normal session data and log data, the communication, access and service dependency relationship between nodes is mined to construct relationship edges.

[0215] Threat implantation: when a new abnormal event or alarm occurs, the system automatically treats it as a threat node and associates it with a specific device or asset node in the atlas according to its source / destination IP, forming a relationship edge of being attacked or initiating an attack.

[0216] This atlas can visually show how a threat moves horizontally in the internal network and affects which key assets.

[0217] Core analysis component - normal traffic link graph engine: based on long-term normal business traffic and logs, the legal behavior patterns of each user / business system are learned and modeled. With users, devices and assets as vertices and request-response pairs as directed edges, a detailed business process graph is constructed. The typical frequency, time consumption, data volume, parameter and other behavior baselines of each edge are recorded.

[0218] By comparing real-time traffic with the baseline of normal traffic link graph, abnormal behaviors that deviate from normal behavior patterns can be effectively found, such as unauthorized access, low-frequency slow attack, abnormal operation under legal credentials, etc.

[0219] Audit and report unit: the system automatically generates security audit reports regularly (daily, weekly, monthly), including network overall security situation, abnormal user behavior statistics, network performance quality indicators, etc. All analysis, detection, and audit operations will generate audit logs to ensure traceability.

[0220] Flow backtracking layer is the time machine of the device of the embodiment, which provides investigation and evidence collection capability.

[0221] The backtracking database is a query-optimized database that stores metadata (sessions, logs) aggregated and indexed in multiple dimensions. The dimensions include: physical address (switch port), IP address, application type, network segment, geographic location, etc.

[0222] Interactive backtracking refers to the ability to "drill down" layer by layer.

[0223] First layer: select dimension. For example, suspect an abnormal network segment (192.168.1.0 / 24), first select the "network segment" dimension and enter the network segment.

[0224] Second layer: application list. The system displays all application types (such as HTTP, MySQL, WeChat) found in the network segment, along with traffic statistics. For example, find an unknown P2P application with a surge in traffic, select the application.

[0225] Third layer: session list. The system lists all session data related to the network segment and P2P application, sorted by time, traffic size, etc. Detailed information (five-tuple, time, data volume) for each session can be viewed.

[0226] Fourth layer: packet details. The system loads the raw data packets of the suspicious session from the PCAP repository based on the correlation information recorded in the metadata, allowing for deep packet analysis, viewing of clear text transmission content, or performing payload feature comparison.

[0227] Intelligent backtracking and flow analysis audit layer linkage. When an analyst sees an alert in the audit interface, they can directly click the "backtracking" button. The system automatically uses the timestamp, IP, port, etc. of the alert as initial conditions to jump to the backtracking interface and directly present all session and traffic data related to the alert, greatly improving investigation efficiency.

[0228] The embodiment realizes full-flow storage and fast full-flow data backtracking analysis functions through full-flow situation analysis, comprehensive perspective management, network security management and control, protocol deep analysis, and holographic data evidence collection capability, enabling network analysis to break through the time limit.

[0229] Parallel computing and dedicated hardware acquisition and detection engine enable high-speed packet capture, accurate data flow identification, traffic analysis, abnormal traffic identification, and security detection methods, achieving comprehensive analysis of network traffic. Based on business awareness, deep reconstruction enables post-access evidence collection for network operation and maintenance management, providing solutions for network optimization and security management.

[0230] Distributed deployment enables full-traffic network data storage and backtracking analysis, overcoming time limitations in network analysis. Furthermore, it utilizes correlation analysis, anomaly detection, and machine learning to analyze and detect abnormal behavior, thus uncovering unknown security threats. In data mining, tracking and location, and digital forensics, traffic logs collected by probes ensure traceability of traffic and anomalies.

[0231] Comprehensive network traffic security monitoring involves deploying traffic probes at critical network locations to monitor system traffic. Based on a parallel computing and computing power network platform, it can perform parallel computing collaboration, data entry, packet reception and storage, DPI / DFI decoding and restoration, data statistics, feature matching, protocol decoding, and metadata modeling on multi-core and multi-threaded CPUs, memory, IO, storage, and other hardware resources. It can also perform visualization analysis, retrospective analysis, and anomaly analysis on real-time and historical data, enabling a high-efficiency network traffic and service analysis, troubleshooting, evidence collection, and maintenance support system.

[0232] Example 5

[0233] To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 8 , Figure 8 This is a basic structural block diagram of the computer device in this embodiment.

[0234] The aforementioned computer device 8 includes a memory 81, a processor 82, and a network interface 83 that are interconnected via a system bus. It should be noted that only the computer device 8 with components 81, 82, and 83 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0235] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, or the like. The computer device can interact with a user through a keyboard, a mouse, a remote controller, a touchpad, a voice control device, or the like.

[0236] The memory 81 can include at least one type of readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, or the like), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, or the like. In some embodiments, the memory 81 can be an internal storage unit of the computer device 8, such as a hard disk or a memory of the computer device 8. In other embodiments, the memory 81 can also be an external storage device of the computer device 8, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, or the like. Of course, the memory 81 can include both an internal storage unit and an external storage device of the computer device 8. In this embodiment, the memory 81 is generally used to store an operating system and various application software installed in the computer device 8, such as computer readable instructions of the traffic analysis auditing and backtracking method, or the like. In addition, the memory 81 can also be used to temporarily store various data that have been output or will be output.

[0237] The processor 82 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 82 is generally used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to run computer readable instructions or process data stored in the memory 81, such as computer readable instructions of the traffic analysis auditing and backtracking method.

[0238] The network interface 83 can include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 8 and other electronic devices.

[0239] By implementing this embodiment, the following beneficial effects can be achieved:

[0240] A normal traffic link graph is established, and normal behaviors of users, devices and assets are associated and profiled.

[0241] By constructing a threat traffic link graph and a normal traffic link graph, isolated threat indicators are associated into a visual attack scene, cross-device and cross-level collaborative perception and association analysis are realized, and thus complex attack chains that cannot be discovered by a single security device are accurately identified.

[0242] Embodiment six

[0243] The application also provides another embodiment, that is, a computer readable storage medium storing computer readable instructions, which can be executed by at least one processor to make the at least one processor execute the steps of the traffic analysis audit backtracking method as described above.

[0244] By implementing the embodiment, the following beneficial effects are achieved:

[0245] A normal traffic link graph is established, and normal behaviors of users, devices and assets are associated and profiled.

[0246] By constructing a threat traffic link graph and a normal traffic link graph, isolated threat indicators are associated into a visual attack scene, cross-device and cross-level collaborative perception and association analysis are realized, and thus complex attack chains that cannot be discovered by a single security device are accurately identified.

[0247] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and a general hardware platform as required, and of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk), and includes a plurality of instructions for making a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device) execute the various embodiment methods of the application.

[0248] Obviously, the above-described embodiments are only some embodiments but not all the embodiments of the present application, the preferred embodiments of the present application are shown in the drawings, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or make equivalent replacements to some technical features therein. Any equivalent structure made by using the content of the present application specification and drawings, directly or indirectly applied to other related technical fields, is also within the patent protection scope of the present application.

Claims

1. A traffic analysis audit backtracking method, characterized by, The method comprises the following steps: Collecting original network traffic data and processing the traffic data; Fusing and standardizing the processed traffic data; Based on the fused and standardized multi-source data, constructing an abnormal traffic feature library; Based on the abnormal traffic feature library, constructing a threat traffic link graph; Profiling the normal behavior of users, devices and assets, constructing a normal traffic link graph, comparing real-time traffic with normal traffic to identify deviant behavior and achieve anomaly detection; Through multidimensional backtracking and intelligent association, locating the root cause of security events and performing intelligent backtracking and analysis; The step of constructing an abnormal traffic feature library based on the fused and standardized multi-source data comprises: Based on the fused and standardized multi-source data, locating traffic segments related to abnormal events; Extracting multidimensional features from traffic to form feature vectors for anomaly detection; Standardizing and classifying features to form a reusable feature set for attack feature aggregation; The step of constructing a threat traffic link graph based on the abnormal traffic feature library comprises: Based on the abnormal traffic feature library, identifying devices and assets in the network to provide vertices for graph construction; Establishing the association between devices and assets to form the edges of the graph; Correlating threat events to the graph to visualize attack paths.

2. The flow analysis audit backtracking method of claim 1, wherein, The step of collecting original network traffic data and processing the traffic data comprises: Collecting the original network traffic data of network nodes; Filtering and slicing the original network traffic data; Performing DPI deep packet analysis on the original network traffic data filtered and sliced to identify application protocols and content.

3. The flow analysis audit backtracking method of claim 1, wherein, The step of fusing and standardizing the processed traffic data comprises: Based on the processed traffic data, generating session data; Normalizing log formats from different sources; Storing standardized metadata.

4. The flow analysis audit backtracking method of claim 1, wherein, The step of profiling the normal behavior of users, devices and assets, constructing a normal traffic link graph, comparing real-time traffic with normal traffic to identify deviant behavior and achieving anomaly detection comprises: Extracting complete link data of user business processes, including user normal business traffic links and baseline features; Using vertices to represent users, devices and assets, using directed edges to represent request and response operations, and adding baseline features and sequence number attributes to vertices and directed edges to construct a normal traffic link graph for anomaly detection.

5. The flow analysis audit backtracking method of any one of claims 1 to 4, wherein, The step of locating the root cause of security events through multidimensional backtracking and intelligent association, and performing intelligent backtracking and analysis comprises: Storing multidimensional aggregated data to construct a backtracking database; Through a GUI interface, setting up a multidimensional viewing application list, session list and message details for interactive backtracking; Automatically associating alarms with traffic data for intelligent backtracking.

6. A traffic analysis audit backtracking apparatus characterized by, The method comprises: A processing module for collecting original network traffic data and processing the traffic data; A fusion module for fusing and standardizing the processed traffic data; A feature module is configured to construct an abnormal traffic feature library based on the fused and standardized multi-source data; A threat traffic link module is configured to construct a threat traffic link graph based on the abnormal traffic feature library; A normal traffic link module is configured to profile normal behaviors of users, devices and assets, construct a normal traffic link graph, and identify deviated behaviors by comparing real-time traffic with normal traffic, thereby achieving abnormal detection; An analysis module is configured to locate a root cause of a security event by multidimensional backtracking and intelligent association, and perform intelligent backtracking and analysis; The feature module is specifically configured to: locate traffic segments related to abnormal events based on the fused and standardized multi-source data; extract multidimensional features from traffic to form feature vectors for abnormal detection; standardize and classify features to form a reusable feature set, and aggregate attack features. The threat traffic link module is specifically configured to: identify devices and assets in a network based on the abnormal traffic feature library, and provide vertices for graph construction; establish association relationships between devices and assets to form edges of a graph; associate threat events to the graph to visualize attack paths.

7. A computer device, comprising: A computer readable storage medium stores computer readable instructions, and a processor executes the computer readable instructions to implement steps of the traffic analysis audit backtracking method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, A computer readable storage medium stores computer readable instructions, and a processor executes the computer readable instructions to implement steps of the traffic analysis audit backtracking method according to any one of claims 1 to 5.

Images