Network monitoring method and equipment of service system, medium and program product

Abstract

The invention discloses a network monitoring method and equipment of a service system, a medium and a program product. The method relates to the technical field of big data and artificial intelligence, and comprises the following steps: fully collecting traffic packets of a service system, and analyzing the collected traffic packets to obtain network traffic data; comparing the network traffic data acquired in real time with the current traffic baseline, and determining suspected abnormal traffic according to a traffic comparison result; performing anomaly detection on the suspected abnormal traffic, and determining an abnormal equipment list according to an anomaly detection result; and comparing the target network traffic data of the target abnormal equipment with the role behavior baseline corresponding to the target abnormal equipment, determining an abnormal behavior according to a behavior comparison result, and performing fine-grained access control on the abnormal behavior. By adopting the above technical scheme, monitoring of full-dimension network information can be realized, a complex network scene is covered through multi-dimension detection, network abnormity is accurately identified, and the false alarm rate and the missing report rate are greatly reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data and artificial intelligence, and particularly relates to a network monitoring method and device for a business system, a medium and a program product. BACKGROUND

[0002] With the advancement of digital transformation, business systems are increasingly complex and distributed, and are facing increasingly diverse and concealed network threats. At the same time, the stability, security and compliance requirements of business systems are continuously improving, and it is necessary to master the network traffic state in real time, accurately identify abnormal behavior and respond quickly.

[0003] Existing technologies rely on detection logic based on fixed threshold comparison, but in actual business, there are obvious periodic fluctuations in traffic, and fixed thresholds will result in a large number of false positives. At the same time, for non-traffic threshold anomalies, existing technologies are completely unable to identify, forming a monitoring blind area. Although the existing technology can achieve monitoring of network information, the monitoring dimension is single, and the robustness of network information protection is low. SUMMARY

[0004] The present application provides a network monitoring method, device, medium and program product for a business system, which can realize monitoring of full-dimensional network information, cover complex network scenarios through multi-dimensional detection, accurately identify network anomalies, and greatly reduce false positive and false negative rates.

[0005] According to an aspect of the present application, a network monitoring method for a business system is provided, comprising:

[0006] collecting traffic packets of the business system in full amount, and analyzing each collected traffic packet to obtain network traffic data;

[0007] comparing the real-time obtained network traffic data with a current traffic baseline, and determining suspected abnormal traffic according to a traffic comparison result;

[0008] performing abnormality detection on the suspected abnormal traffic, and determining an abnormal device list according to an abnormality detection result;

[0009] comparing target network traffic data of a target abnormal device with a role behavior baseline corresponding to the target abnormal device, determining abnormal behavior according to a behavior comparison result, and performing fine-grained access control on the abnormal behavior.

[0010] Optionally, after collecting traffic packets of the business system in full amount and analyzing each collected traffic packet to obtain network traffic data, the method further comprises:

[0011] store the network traffic data in a data platform, and whenever an update time point of the traffic baseline is reached, extract the multiple traffic index data of the traffic baseline from the network traffic data collected in a target time interval;

[0012] perform preprocessing on the traffic index data, and group the traffic index data after preprocessing according to a time dimension;

[0013] adjust the threshold values of the multiple traffic indexes in the traffic baseline according to the grouped traffic index data.

[0014] The advantage of such a setting is that by regularly updating the baseline, the business scenario changes can be adapted, and normal traffic is avoided from being misjudged as abnormal due to a fixed baseline. By automatically extracting target data, preprocessing, and adjusting threshold values, manual statistical analysis by operation and maintenance personnel is not required, manpower investment is reduced, and by updating the data without known abnormalities, extreme values and noise are removed, which can ensure that the new baseline can truly reflect the current normal traffic rules and provide a reliable basis for subsequent abnormality determination.

[0015] Optionally, after collecting the traffic packets of the business system in full and performing analysis on each collected traffic packet to obtain the network traffic data, the method further includes:

[0016] store the network traffic data in a data platform, and whenever an update time point of the role behavior baseline is reached, extract the multiple user behavior data of the role behavior baseline from each network traffic data collected in a target time interval;

[0017] group the user behavior data according to user tags, and perform behavior rule statistics on each group of user behavior;

[0018] adjust the normal behavior boundary of the role behavior baseline corresponding to the target user tag according to the behavior rule statistics result of the target user tag.

[0019] The advantage of such a setting is that by updating the baseline boundary, normal user behavior can be avoided from being misjudged, and by updating the normal behavior boundary based on the latest behavior rule, truly abnormal behavior can be more sensitively captured.

[0020] Optionally, the real-time obtained network traffic data is compared with the current traffic baseline to determine suspected abnormal traffic according to a traffic comparison result, including:

[0021] compare the network traffic data with the target traffic index threshold value of the corresponding time interval in the current traffic baseline according to the data collection time of the network traffic data, and when it is determined that the network traffic data exceeds the target traffic index threshold value, determine the network traffic data as suspected abnormal traffic; and

[0022] Periodically detecting the network traffic data, and determining the network traffic data as suspected abnormal traffic when detecting that the network traffic data belongs to non-periodic traffic.

[0023] The advantage of this setting is that it covers both numerical and pattern anomalies by combining statistical threshold comparison with periodicity detection, avoiding missed judgments caused by a single dimension, and improving the accuracy and comprehensiveness of suspected abnormal traffic monitoring.

[0024] Optionally, performing anomaly detection on the suspected abnormal traffic, and determining an abnormal device list according to the anomaly detection result, including:

[0025] Comparing the application layer features of the suspected abnormal traffic with a preset signature library, and when detecting that the target suspected abnormal traffic successfully matches the preset signature library, determining abnormal device information according to the user layer features of the target suspected abnormal traffic; and

[0026] Detecting whether the suspected abnormal traffic contains sensitive data transmitted in plaintext and protocol field missing, and when detecting any one, determining abnormal device information according to the user layer features of the target suspected abnormal traffic.

[0027] The advantage of this setting is that it identifies known threats through application layer feature comparison with a preset signature library, and identifies unknown information anomalies through sensitive data plaintext detection and protocol field missing detection, thereby reducing threat omissions, and locking abnormal devices based on the user layer features of suspected abnormal traffic, which can ensure that subsequent control can accurately act on target devices.

[0028] Optionally, comparing the target network traffic data of the target abnormal device with the role behavior baseline corresponding to the target abnormal device, determining abnormal behavior according to the behavior comparison result, and performing fine-grained access control on the abnormal behavior, including:

[0029] Comparing the target network traffic data of the target abnormal device with the role behavior baseline corresponding to the target abnormal device, and when determining that the target abnormal device has abnormal behavior according to the behavior comparison result, determining the multi-dimensional dynamic adjustment parameter of the target abnormal device according to the abnormal behavior;

[0030] According to the multi-dimensional dynamic adjustment parameter, performing corresponding temporary operation restriction on the target abnormal device.

[0031] The advantage of this setting is that fine-grained control is only performed on confirmed abnormal behavior, which can accurately limit the impact of abnormal behavior and reduce the impact on normal business, blocking risk spread while ensuring core business operation, and real-time monitoring of device behavior can gradually remove restrictions after abnormality stops and verification passes, improving user experience and business efficiency.

[0032] Optionally, after collecting the traffic packets of the full-service system and analyzing each collected traffic packet to obtain network traffic data, the method further includes:

[0033] According to the network traffic data, multi-level performance index parameters are calculated, and performance detection is performed according to the multi-level performance index parameters.

[0034] When the performance index to be optimized is detected, the performance index to be optimized is optimized.

[0035] The advantage of such a setting is that the network layer, the application layer, and the service layer are covered, the performance bottleneck is comprehensively monitored, the problem of normal technology but unavailable business caused by single index monitoring is avoided, manual intervention detection is not required, the method is suitable for a high-concurrency scenario, and the performance problem can be quickly solved.

[0036] According to another aspect of the present application, an electronic device is provided, and the electronic device includes:

[0037] at least one processor; and

[0038] a memory connected to the at least one processor in communication; wherein

[0039] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network monitoring method of the service system according to any one of the embodiments of the present application.

[0040] According to another aspect of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores computer instructions for enabling a processor to implement the network monitoring method of the service system according to any one of the embodiments of the present application when the processor executes the computer instructions.

[0041] According to another aspect of the present application, a computer program product is provided, and the computer program product includes a computer program, and the computer program implements the network monitoring method of the service system according to any one of the embodiments of the present application when executed by a processor.

[0042] The technical scheme of the embodiment of the application comprises the following steps: collecting traffic packets of a service system in a full amount, analyzing each traffic packet collected, obtaining network traffic data, comparing the real-time obtained network traffic data with a current traffic baseline, determining suspected abnormal traffic according to a traffic comparison result, performing abnormal detection on the suspected abnormal traffic, determining an abnormal device list according to an abnormal detection result, comparing target network traffic data of a target abnormal device with a role behavior baseline corresponding to the target abnormal device, determining abnormal behavior according to a behavior comparison result, and performing fine-grained access control on the abnormal behavior. In this way, network layer traffic abnormality and user behavior abnormality can be accurately located, full-dimension network information can be monitored, the situation of missed judgment and misjudgment caused by incomplete collection or single judgment can be avoided, the false positive rate and the false negative rate can be greatly reduced, the risk of malicious attack can be reduced, fine-grained control is only performed on the confirmed abnormal behavior, and the influence on normal business is reduced.

[0043] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0045] Figure 1 is a flow chart of a network monitoring method of a service system according to an embodiment of the application;

[0046] Figure 2 is a flow chart of another network monitoring method of a service system according to an embodiment of the application;

[0047] Figure 3 is a structural schematic diagram of a network monitoring device of a service system according to an embodiment of the application;

[0048] Figure 4 is a structural schematic diagram of an electronic device for implementing a network monitoring method of a service system according to an embodiment of the application. DETAILED DESCRIPTION

[0049] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative work should belong to the protection scope of the present application.

[0050] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the terms thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to include only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0051] Embodiment one

[0052] Figure 1 A flowchart of a network monitoring method of a business system provided by the first embodiment of the present application, the present embodiment can be applicable to the case of monitoring and access control of abnormal behavior of the network of the business system, and the method can be executed by a network monitoring device of the business system. The network monitoring device of the business system can be realized in the form of hardware and / or software, and can generally be configured in a computer or processor with data processing function. As shown in the figure, the method comprises: Figure 1

[0053] S110, all traffic packets of the business system are collected, and each collected traffic packet is parsed to obtain network traffic data.

[0054] Optionally, all network traffic packets of the core link of the business system can be collected without omission by combining the mirror port and the test access point device. The core link can refer to a switch, a server, an application programming interface gateway, a gateway outlet, etc.

[0055] Optionally, the collected traffic packets can be parsed to extract structured data, so as to obtain the network traffic data of the traffic packets. The network traffic data can include network layer data, application layer data and user layer data.

[0056] ​Optionally, the network layer data can refer to port number, transmission control protocol connection state, bandwidth occupation, packet loss rate, delay, etc. The application layer data can refer to protocol type, request path, request parameter, response code, etc. The user layer data can refer to login account, device address, browser user agent, access time, operation frequency, etc.

[0057] S120, compare the real-time acquired network traffic data with the current traffic baseline, and determine the suspected abnormal traffic according to the traffic comparison result.

[0058] Optionally, the traffic baseline can refer to a model constructed based on historical normal network traffic data, for maintaining the corresponding relationship between the time period, network traffic index and threshold. The traffic baseline can be used to judge whether the real-time traffic conforms to the periodicity and stability rules. In the traffic baseline, each group can include the mean value and fluctuation range of multiple network traffic indexes such as bandwidth utilization, transmission control protocol connection number and core interface request volume.

[0059] Optionally, comparing the real-time traffic data with the traffic baseline to determine the suspected abnormal traffic can include comparing the network traffic data with the target traffic index threshold in the corresponding time interval in the current traffic baseline and periodically detecting the network traffic data.

[0060] Optionally, comparing the network traffic data with the target traffic index threshold in the corresponding time interval in the current traffic baseline can include matching the corresponding period of the traffic baseline according to the data collection time of the network traffic data, for example, matching the real-time traffic at 10:00 with the traffic baseline corresponding to 9:00-12:00 on weekdays, and then comparing the core index according to the matched traffic baseline, for example, the real-time bandwidth utilization is 95%, while the baseline threshold of bandwidth utilization corresponding to this period is 80%, which is marked as suspected abnormal traffic.

[0061] Optionally, periodically detecting the network traffic data can include analyzing the periodicity of real-time traffic with time series analysis algorithm and comparing with the historical same period rule. If the real-time traffic has no periodicity characteristics, it is determined as non-periodic traffic, which is marked as suspected abnormal traffic, for example, there is a business peak traffic at 2:00 a.m. on Sunday, while the same period in the historical same period rule is low traffic, so the business peak traffic is suspected abnormal traffic.

[0062] S130, performing abnormal detection on the suspected abnormal traffic, and determining the abnormal device list according to the abnormal detection result.

[0063] Optionally, the suspected abnormal traffic can be subjected to signature matching and information anomaly detection, and according to the detection result, the malicious traffic is screened out from the suspected abnormal traffic, and then the abnormal device generating the malicious traffic is determined according to the malicious traffic.

[0064] Optionally, the signature matching can refer to comparing the application layer features of the suspected abnormal traffic with a preset signature library, and if the target suspected abnormal traffic can be successfully matched with the preset signature library, it is determined as malicious traffic, and the abnormal device is determined through user layer data.

[0065] Optionally, if it is detected that there is sensitive data plaintext transmission or protocol field missing in the target suspected traffic, it is determined as malicious traffic, and the abnormal device is determined through user layer data.

[0066] S140, comparing the target network traffic data of the target abnormal device with the role behavior baseline corresponding to the target abnormal device, determining the abnormal behavior according to the behavior comparison result, and performing fine-grained access control on the abnormal behavior.

[0067] Optionally, the role behavior baseline can refer to a model constructed based on historical normal behavior data of a user role or an individual user, used to determine whether the user operation conforms to the role or individual habit. The role behavior baseline can maintain the corresponding relationship between the user behavior and the behavior boundary, and can maintain access time, commonly used interface, operation range, environmental characteristics and other information for each different role or user.

[0068] Optionally, each target abnormal device in the abnormal device list can be compared one by one, and the user role corresponding to the target abnormal device can be determined in the business system. For example, when the media access control address of the target abnormal device is determined to be associated with a login account of operation Zhang San, it can correspond to the role behavior baseline of the operation, and then the comparison is performed.

[0069] Optionally, the target network traffic data is the traffic data corresponding to the target abnormal device, and if the user behavior in the target network traffic data exceeds the corresponding role behavior baseline, it is determined as an abnormal behavior. For example, if the user data download threshold of the operation user in the role behavior baseline is set to 100, but the user downloads 200 in the target network traffic data, it is confirmed as an abnormal behavior.

[0070] Optionally, the fine-grained access control can perform access control from multiple dimensions such as user role, access environment, operation content and behavior frequency.

[0071] Optionally, the fine-grained access control can perform access control from multiple dimensions such as user role, access environment, operation content and behavior frequency.

[0072] The target network traffic data of the target abnormal device is compared with the baseline behavior of the role corresponding to the target abnormal device. When it is determined that the target abnormal device has abnormal behavior based on the behavior comparison results, the multi-dimensional dynamic adjustment parameters of the target abnormal device are determined based on the abnormal behavior.

[0073] Based on multi-dimensional dynamic adjustment parameters, corresponding temporary operational restrictions are imposed on the target abnormal device.

[0074] Optionally, when it is determined that the target abnormal device has abnormal behavior based on the behavior comparison results, the type of abnormal behavior is determined, and the severity of the abnormal behavior is determined based on the type of abnormal behavior. For example, login from a different location corresponds to a mild abnormality, and cross-permission access corresponds to a moderate abnormality. Then, the corresponding multi-dimensional dynamic adjustment parameters are determined based on the severity of the abnormal behavior.

[0075] Optionally, the parameters for multi-dimensional dynamic adjustment can include permission scope, operation restrictions, time restrictions, and environmental restrictions. Permission scope can refer to restricting the interfaces that users are allowed or prohibited from accessing. Operation restrictions can refer to restricting users' query, modification, deletion, and other behaviors. Time restrictions can refer to the time limit of the restrictions. Environmental restrictions can restrict the user's network environment, such as allowing access to the business system only through the intranet.

[0076] Optionally, abnormal behavior of abnormal devices can be monitored in real time. If the abnormal behavior stops, further security verification can be performed. After the security verification is completed, restrictions can be gradually lifted. If the abnormality continues, control measures can be upgraded.

[0077] The advantages of this setup are: fine-grained control is applied only to confirmed abnormal behaviors, which can precisely limit the impact of abnormal behaviors and reduce the impact on normal business operations. This not only prevents the spread of risks but also ensures the operation of core businesses. Real-time monitoring of device behavior can gradually lift restrictions after the abnormality stops and is verified, thereby improving user experience and business efficiency.

[0078] The technical solution of this invention collects all traffic packets from the business system, parses each collected traffic packet to obtain network traffic data, compares the real-time network traffic data with the current traffic baseline, identifies suspected abnormal traffic based on the traffic comparison results, performs anomaly detection on the suspected abnormal traffic, determines a list of abnormal devices based on the anomaly detection results, compares the target network traffic data of the target abnormal device with the baseline of the role behavior corresponding to the target abnormal device, determines the abnormal behavior based on the behavior comparison results, and performs fine-grained access control on the abnormal behavior. This approach covers both network layer traffic anomalies and accurately locates user behavior anomalies, enabling monitoring of network information from all dimensions. It avoids missed or false positives caused by incomplete collection or single judgment, significantly reducing false positive and false negative rates, reducing the risk of malicious attacks, and only performing fine-grained control on confirmed abnormal behaviors, minimizing the impact on normal business operations.

[0079] Example 2

[0080] Figure 2 This is a flowchart illustrating a network monitoring method for a business system according to Embodiment 2 of the present invention. Based on the above embodiments, this embodiment specifically describes the network monitoring method for a business system. Figure 2 As shown, the method includes:

[0081] S210: Collect all traffic packets from the business system and parse each collected traffic packet to obtain network traffic data.

[0082] This process, after collecting all traffic packets from the business system and parsing each collected traffic packet to obtain network traffic data, may also include:

[0083] Network traffic data is stored in the data platform, and whenever the update time of the traffic baseline is reached, multiple traffic indicator data of the traffic baseline are extracted from the network traffic data collected within the target time interval.

[0084] The traffic indicator data is preprocessed, and the preprocessed traffic indicator data is grouped according to the time dimension;

[0085] Based on the grouped traffic indicator data, adjust the thresholds of each traffic indicator in the traffic baseline.

[0086] Optionally, the parsed network traffic data can be stored in a unified data platform in real time, and an update cycle can be set so that the update can be started automatically whenever the time point is reached. Within the target time interval corresponding to the update cycle, traffic data without known anomalies can be filtered out, and multiple traffic indicator data can be extracted from the traffic data.

[0087] Optionally, preprocessing the traffic metrics may include removing extreme values ​​and smoothing noisy data to ensure the accuracy of the metrics data; then regrouping them by time dimension, for example, by multiple time periods such as weekdays and weekends; and calculating the new mean and fluctuation range of each group of metrics based on the traffic metrics data, and adjusting the traffic baseline threshold.

[0088] The advantages of this setup are: by regularly updating the baseline, it can adapt to changes in business scenarios and avoid normal traffic being misjudged as abnormal due to a fixed baseline; by automatically extracting target data, preprocessing and adjusting thresholds, it eliminates the need for manual statistical analysis by operations and maintenance personnel, reducing manpower input; by filtering out data without known anomalies for updates and removing extreme values ​​and noise, it can ensure that the new baseline can truly reflect the current normal traffic patterns and provide a reliable basis for subsequent anomaly judgment.

[0089] This process, after collecting all traffic packets from the business system and parsing each collected traffic packet to obtain network traffic data, may also include:

[0090] Network traffic data is stored in the data platform, and whenever the update time of the role behavior baseline is reached, multiple user behavior data of the role behavior baseline are extracted from the network traffic data collected within the target time interval.

[0091] User behavior data is grouped according to user tags, and behavioral patterns are statistically analyzed for each group of users.

[0092] Based on the statistical results of the behavioral patterns of target user tags, adjust the normal behavioral boundaries of the baseline behavior of the roles corresponding to the target user tags.

[0093] Optionally, the parsed network traffic data can be stored in a unified data platform in real time, and an update cycle can be set so that the update can be started automatically whenever the time point is reached. Within the target time interval, the access time, interface, and frequency behavior data of each user can be extracted, and known abnormal behavior data can be excluded. The data can be grouped by user tags, and the behavior patterns of each group can be statistically analyzed. The baseline boundary can be updated based on the statistical results. For example, the access time of the administrator role baseline can be extended from 17:00 to 18:00.

[0094] The advantage of this setup is that by updating the baseline boundaries, we can avoid misjudging normal user behavior, and by updating the boundaries of normal behavior based on the latest behavioral patterns, we can more accurately capture real anomalies.

[0095] This process, after collecting all traffic packets from the business system and parsing each collected traffic packet to obtain network traffic data, may also include:

[0096] Calculate multi-level performance index parameters based on network traffic data, and perform performance testing based on these parameters.

[0097] When a performance metric to be optimized is detected, the metric is tuned.

[0098] Optionally, multi-level performance metrics can cover the network layer, application layer, and business layer. Network layer performance metrics may include bandwidth utilization, latency, packet loss rate, etc. Application layer performance metrics may include interface response time, error code rate, and concurrent connection count, etc. Business layer performance metrics may include order submission success rate, payment completion rate, page load time, etc.

[0099] Optionally, performance thresholds for various performance indicators can be preset. The performance indicators to be optimized are determined based on the performance thresholds, and the optimization scheme is determined based on the dimension to which the performance indicator to be optimized belongs. After optimization, the indicator is continuously monitored for a certain period of time. If the performance of the indicator is optimized, the optimization scheme is determined to be effective; otherwise, the optimization scheme is determined to be ineffective, and a manual intervention alarm is triggered.

[0100] The advantages of this setup are: it covers three levels of metrics—network layer, application layer, and business layer—to comprehensively monitor performance bottlenecks, avoid the problem of technically normal but business unavailability caused by monitoring a single metric, eliminates the need for manual intervention in detection, is suitable for high-concurrency scenarios, and can quickly resolve performance issues.

[0101] S220. Compare the real-time network traffic data with the current traffic baseline, and determine the suspected abnormal traffic based on the traffic comparison results.

[0102] This includes comparing real-time network traffic data with the current traffic baseline, and identifying suspected abnormal traffic based on the comparison results. This can include:

[0103] Based on the data collection time of the network traffic data, the network traffic data is compared with the target traffic indicator threshold for the corresponding time interval in the current traffic baseline. When it is determined that the network traffic data exceeds the target traffic indicator threshold, the network traffic data is identified as suspected abnormal traffic; and,

[0104] The system performs periodic pattern detection on network traffic data, and identifies non-periodic network traffic as suspected abnormal traffic when it detects non-periodic network traffic.

[0105] Optionally, the collection time of real-time network traffic data can be obtained first, and then the target indicator threshold in the traffic baseline can be matched according to the collection time of the network traffic data. If the real-time data exceeds the threshold, it can be directly marked as suspected abnormal traffic.

[0106] Optionally, time series analysis algorithms can be used to compare the patterns of the same period in history to analyze the periodicity of real-time traffic; if the real-time traffic does not have periodic characteristics, it is determined to be non-periodic traffic and marked as suspected anomaly.

[0107] Optionally, the two types of suspected abnormal traffic can be merged and deduplicated to form a final list of suspected abnormal traffic, thus avoiding duplicate marking.

[0108] The advantage of this setup is that it combines statistical threshold comparison with periodic pattern detection, covering both numerical anomalies and pattern anomalies, avoiding missed detections caused by relying on a single dimension, and improving the accuracy and comprehensiveness of suspected abnormal traffic monitoring.

[0109] S230. Perform anomaly detection on suspected abnormal traffic and determine the list of abnormal devices based on the anomaly detection results.

[0110] This includes detecting suspected abnormal traffic and determining a list of abnormal devices based on the detection results, which may include:

[0111] The application-layer characteristics of suspected abnormal traffic are obtained and compared with a preset signature database. When a target suspected abnormal traffic is detected to successfully match the preset signature database, the abnormal device information is determined based on the user-layer characteristics of the target suspected abnormal traffic.

[0112] The system detects whether suspected abnormal traffic contains sensitive data transmitted in plaintext or missing protocol fields. When any of these are detected, it determines the abnormal device information based on the user-layer characteristics of the target suspected abnormal traffic.

[0113] Optionally, the preset signature library can refer to a set of features used to identify known threats or business anomalies. The preset signature library may include security threat signatures and business anomaly signatures; application layer features of suspected abnormal traffic may include, for example, Hypertext Transfer Protocol request bodies, database query commands, file hash values, etc.

[0114] Optionally, if the target suspected abnormal traffic successfully matches the preset signature database, it is determined to be malicious traffic, and abnormal device information is determined through the user-level characteristics of the traffic. The user-level characteristics may include, but are not limited to, the device bound to the associated login account, the device's media access control address, and other information.

[0115] Optionally, regular expressions can be used to match sensitive data in the traffic, detect whether it is transmitted in plaintext via the Hypertext Transfer Protocol, and parse the protocol fields to check for any missing key fields. If any anomaly is detected, the abnormal device is associated with the source Internet Protocol address and the device's Media Access Control address and added to the list of abnormal devices.

[0116] Furthermore, the historical traffic of devices in the list of abnormal devices can be cross-validated to eliminate falsely identified devices.

[0117] The advantages of this setup are: it identifies known threats by comparing application-layer features with a preset signature database, identifies unknown information anomalies by detecting plaintext sensitive data and missing protocol fields, thereby reducing threat omissions, and locks down abnormal devices based on user-layer features of suspected abnormal traffic, ensuring that subsequent control measures can be accurately applied to the target devices.

[0118] S240. Compare the target network traffic data of the target abnormal device with the baseline of the role behavior corresponding to the target abnormal device, and when it is determined that the target abnormal device has abnormal behavior based on the behavior comparison result, determine the multi-dimensional dynamic adjustment parameters of the target abnormal device based on the abnormal behavior.

[0119] S250: Apply temporary operational restrictions to the target abnormal device based on multi-dimensional dynamic adjustment parameters.

[0120] The technical solution of this invention collects all traffic packets from the business system, parses each collected traffic packet to obtain network traffic data, compares the real-time network traffic data with the current traffic baseline, identifies suspected abnormal traffic based on the traffic comparison results, performs anomaly detection on the suspected abnormal traffic, determines a list of abnormal devices based on the anomaly detection results, compares the target network traffic data of the target abnormal device with the baseline of the role behavior corresponding to the target abnormal device, determines the abnormal behavior based on the behavior comparison results, and performs fine-grained access control on the abnormal behavior. This approach covers both network layer traffic anomalies and accurately locates user behavior anomalies, enabling monitoring of network information from all dimensions. It avoids missed or false positives caused by incomplete collection or single judgment, significantly reducing false positive and false negative rates, reducing the risk of malicious attacks, and only performing fine-grained control on confirmed abnormal behaviors, minimizing the impact on normal business operations.

[0121] Example 3

[0122] Figure 3 This is a schematic diagram of the structure of a network monitoring device for a business system provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a network traffic data acquisition module 310, a suspected abnormal traffic confirmation module 320, an abnormal device identification module 330, and an abnormal behavior control module 340.

[0123] The network traffic data acquisition module 310 is used to collect all traffic packets from the business system and parse each collected traffic packet to obtain network traffic data.

[0124] The suspected abnormal traffic confirmation module 320 is used to compare the real-time acquired network traffic data with the current traffic baseline and determine the suspected abnormal traffic based on the traffic comparison results.

[0125] The abnormal device identification module 330 is used to detect abnormal traffic and determine the list of abnormal devices based on the detection results.

[0126] The abnormal behavior control module 340 is used to compare the target network traffic data of the target abnormal device with the baseline behavior of the corresponding role of the target abnormal device, determine the abnormal behavior based on the behavior comparison result, and perform fine-grained access control on the abnormal behavior.

[0127] The technical solution of this invention collects all traffic packets from the business system, parses each collected traffic packet to obtain network traffic data, compares the real-time network traffic data with the current traffic baseline, identifies suspected abnormal traffic based on the traffic comparison results, performs anomaly detection on the suspected abnormal traffic, determines a list of abnormal devices based on the anomaly detection results, compares the target network traffic data of the target abnormal device with the baseline of the role behavior corresponding to the target abnormal device, determines the abnormal behavior based on the behavior comparison results, and performs fine-grained access control on the abnormal behavior. This approach covers both network layer traffic anomalies and accurately locates user behavior anomalies, enabling monitoring of network information from all dimensions. It avoids missed or false positives caused by incomplete collection or single judgment, significantly reducing false positive and false negative rates, reducing the risk of malicious attacks, and only performing fine-grained control on confirmed abnormal behaviors, minimizing the impact on normal business operations.

[0128] Based on the above embodiments, a traffic baseline construction module may also be included, for:

[0129] Network traffic data is stored in the data platform, and whenever the update time of the traffic baseline is reached, multiple traffic indicator data of the traffic baseline are extracted from the network traffic data collected within the target time interval.

[0130] The traffic indicator data is preprocessed, and the preprocessed traffic indicator data is grouped according to the time dimension;

[0131] Based on the grouped traffic indicator data, adjust the thresholds of each traffic indicator in the traffic baseline.

[0132] Based on the above embodiments, a role behavior baseline construction module may also be included, for:

[0133] Network traffic data is stored in the data platform, and whenever the update time of the role behavior baseline is reached, multiple user behavior data of the role behavior baseline are extracted from the network traffic data collected within the target time interval.

[0134] User behavior data is grouped according to user tags, and behavioral patterns are statistically analyzed for each group of users.

[0135] Based on the statistical results of the behavioral patterns of target user tags, adjust the normal behavioral boundaries of the baseline behavior of the roles corresponding to the target user tags.

[0136] Based on the above embodiments, the suspected abnormal traffic confirmation module 320 can be specifically used for:

[0137] Based on the data collection time of the network traffic data, the network traffic data is compared with the target traffic indicator threshold for the corresponding time interval in the current traffic baseline. When it is determined that the network traffic data exceeds the target traffic indicator threshold, the network traffic data is identified as suspected abnormal traffic; and,

[0138] The system performs periodic pattern detection on network traffic data, and identifies non-periodic network traffic as suspected abnormal traffic when it detects non-periodic network traffic.

[0139] Based on the above embodiments, the abnormal device identification module 330 can be specifically used for:

[0140] The application-layer characteristics of suspected abnormal traffic are obtained and compared with a preset signature database. When a target suspected abnormal traffic is detected to successfully match the preset signature database, the abnormal device information is determined based on the user-layer characteristics of the target suspected abnormal traffic.

[0141] The system detects whether suspected abnormal traffic contains sensitive data transmitted in plaintext or missing protocol fields. When any of these are detected, it determines the abnormal device information based on the user-layer characteristics of the target suspected abnormal traffic.

[0142] Based on the above embodiments, the abnormal behavior control module 340 can be specifically used for:

[0143] The target network traffic data of the target abnormal device is compared with the baseline behavior of the role corresponding to the target abnormal device. When it is determined that the target abnormal device has abnormal behavior based on the behavior comparison results, the multi-dimensional dynamic adjustment parameters of the target abnormal device are determined based on the abnormal behavior.

[0144] Based on multi-dimensional dynamic adjustment parameters, corresponding temporary operational restrictions are imposed on the target abnormal device.

[0145] Based on the above embodiments, a performance index optimization module may also be included, specifically for:

[0146] Calculate multi-level performance index parameters based on network traffic data, and perform performance testing based on these parameters.

[0147] When a performance metric to be optimized is detected, the metric is tuned.

[0148] The network monitoring device for a business system provided in this embodiment of the invention can execute the network monitoring method for a business system provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0149] Example 4

[0150] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0151] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0152] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0153] Processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the network monitoring method for a business system described in the embodiments of the present invention. That is:

[0154] Collect all traffic packets from the business system and parse each collected traffic packet to obtain network traffic data;

[0155] The real-time network traffic data is compared with the current traffic baseline, and suspected abnormal traffic is identified based on the traffic comparison results.

[0156] Perform anomaly detection on suspected abnormal traffic and determine the list of abnormal devices based on the anomaly detection results;

[0157] The target network traffic data of the abnormal device is compared with the baseline behavior of the corresponding role. Abnormal behavior is determined based on the behavior comparison results, and fine-grained access control is implemented for the abnormal behavior.

[0158] In some embodiments, the network monitoring method of the business system may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network monitoring method of the business system described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network monitoring method of the business system by any other suitable means (e.g., by means of firmware).

[0159] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0160] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0161] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0162] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0163] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0164] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0165] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0166] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network monitoring method for a business system, characterized in that, include: Collect all traffic packets from the business system and parse each collected traffic packet to obtain network traffic data; The real-time network traffic data is compared with the current traffic baseline, and suspected abnormal traffic is identified based on the traffic comparison results. Perform anomaly detection on suspected abnormal traffic and determine the list of abnormal devices based on the anomaly detection results; The target network traffic data of the abnormal device is compared with the baseline behavior of the corresponding role. Abnormal behavior is determined based on the behavior comparison results, and fine-grained access control is implemented for the abnormal behavior.

2. The method according to claim 1, characterized in that, After collecting all traffic packets from the business system and parsing each collected traffic packet to obtain network traffic data, the process also includes: Network traffic data is stored in the data platform, and whenever the update time of the traffic baseline is reached, multiple traffic indicator data of the traffic baseline are extracted from the network traffic data collected within the target time interval. The traffic indicator data is preprocessed, and the preprocessed traffic indicator data is grouped according to the time dimension; Based on the grouped traffic indicator data, adjust the thresholds of each traffic indicator in the traffic baseline.

3. The method according to claim 1, characterized in that, After collecting all traffic packets from the business system and parsing each collected traffic packet to obtain network traffic data, the process also includes: Network traffic data is stored in the data platform, and whenever the update time of the role behavior baseline is reached, multiple user behavior data of the role behavior baseline are extracted from the network traffic data collected within the target time interval. User behavior data is grouped according to user tags, and behavioral patterns are statistically analyzed for each group of users. Based on the statistical results of the behavioral patterns of target user tags, adjust the normal behavioral boundaries of the baseline behavior of the roles corresponding to the target user tags.

4. The method according to claim 1, characterized in that, The real-time network traffic data is compared with the current traffic baseline, and suspected abnormal traffic is identified based on the comparison results, including: Based on the data collection time of the network traffic data, the network traffic data is compared with the target traffic indicator threshold for the corresponding time interval in the current traffic baseline. When it is determined that the network traffic data exceeds the target traffic indicator threshold, the network traffic data is identified as suspected abnormal traffic; and, The system performs periodic pattern detection on network traffic data, and identifies non-periodic network traffic as suspected abnormal traffic when it detects non-periodic network traffic.

5. The method according to claim 1, characterized in that, Anomaly detection is performed on suspected abnormal traffic, and a list of abnormal devices is determined based on the anomaly detection results, including: The application-layer characteristics of suspected abnormal traffic are obtained and compared with a preset signature database. When a target suspected abnormal traffic is detected to successfully match the preset signature database, the abnormal device information is determined based on the user-layer characteristics of the target suspected abnormal traffic. The system detects whether suspected abnormal traffic contains sensitive data transmitted in plaintext or missing protocol fields. When any of these are detected, it determines the abnormal device information based on the user-layer characteristics of the target suspected abnormal traffic.

6. The method according to claim 1, characterized in that, The target network traffic data of the abnormal device is compared with the baseline behavior of the corresponding role. Based on the comparison results, abnormal behavior is determined, and fine-grained access control is implemented for this abnormal behavior, including: The target network traffic data of the target abnormal device is compared with the baseline behavior of the role corresponding to the target abnormal device. When it is determined that the target abnormal device has abnormal behavior based on the behavior comparison results, the multi-dimensional dynamic adjustment parameters of the target abnormal device are determined based on the abnormal behavior. Based on multi-dimensional dynamic adjustment parameters, corresponding temporary operational restrictions are imposed on the target abnormal device.

7. The method according to claim 1, characterized in that, After collecting all traffic packets from the business system and parsing each collected traffic packet to obtain network traffic data, the process also includes: Calculate multi-level performance index parameters based on network traffic data, and perform performance testing based on these parameters. When a performance metric to be optimized is detected, the metric is tuned.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network monitoring method of the business system according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the network monitoring method of the business system according to any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the network monitoring method for the business system according to any one of claims 1-7.

Images