A cross-border data transmission security monitoring method and system based on traffic analysis

Abstract

The present application relates to the technical field of flow monitoring, in particular to a cross-border data transmission security monitoring method and system based on flow analysis, comprising the following steps: collecting export data packets and extracting address port protocol time and direction information, combining address segment mapping registration interval number and country code, identifying same direction message jump and country change, verifying parameter change and destination address repetition, determining session boundary and generating cross-border session marker set. In the present application, address, port, protocol, timestamp and direction information are jointly organized around continuous message sequence, and after address is mapped to interval number, country code is associated, the country switching point can be positioned to the specific message position, combined with interval jump, continuous position and country code verification, short-term fluctuation and real cross-border boundary are distinguished, combined with parameter change increment, destination address repetition proportion and boundary merging result, cross-border session marker containing time range, direction feature and boundary landing point is formed.

Description

Technical Field

[0001] This invention relates to the field of traffic monitoring technology, specifically to a method and system for secure monitoring of cross-border data transmission based on traffic analysis. Background Technology

[0002] The field of traffic monitoring technology encompasses techniques for the continuous observation and analysis of data transmission behavior in a network. Its core content involves the collection, parsing, statistical analysis, and correlation processing of data packets during transmission. This field typically revolves around network packet capture technology, five-tuple-based traffic identification methods, deep packet inspection technology, and time-series-based traffic feature modeling. By structuring information such as source address, destination address, port, protocol type, and transmission timing, a systematic description of network communication behavior is achieved. Furthermore, this technology also includes the identification and classification of data exchange behavior across network boundaries. By constructing a traffic feature database and rule matching mechanism, different types of service traffic are distinguished and labeled, thus forming a complete network traffic monitoring and analysis system.

[0003] Among them, the cross-border data transmission security monitoring method based on traffic analysis refers to the technical solution for identifying and analyzing the behavior of data during transmission between networks in different countries or regions. It mainly covers technical aspects such as the identification and marking of cross-border data flows, transmission path tracking, and communication content feature matching. This method typically involves deploying traffic acquisition nodes to obtain raw data packets, parsing the packet header fields to obtain source address, destination address, and port information, and combining this with an IP address attribution database to determine cross-border attributes. Simultaneously, it uses session reassembly technology to associate consecutive data packets, further combining content detection methods based on feature string matching to classify the transmitted data, and identifying abnormal transmission behavior according to preset rules, thereby constructing a complete cross-border data transmission monitoring process.

[0004] Existing technologies, in actual operation, primarily output address attribution results, traffic category results, or rule hit results. These various types of information are scattered, often lacking a unified characterization of which communication segment a cross-border activity occurred in, when it began, and when it ended. In scenarios involving short-term egress address drift, frequent link switching, or the same service continuously accessing multiple target addresses, monitoring results easily become blurred. Auditors can only see a few discrete hit records, making it difficult to reconstruct a complete cross-border process. This operational model also increases the burden of manual review, making it difficult to quickly confirm whether adjacent alarms belong to the same event, and the risk scope is not easily converged. If an enterprise's business simultaneously connects to overseas cloud nodes and domestic transit nodes, existing results often appear as multiple independent records appearing side-by-side, making it difficult to determine the true correlation during the handling process. Both the interpretability of alarms and the efficiency of evidence collection are limited. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for security monitoring of cross-border data transmission based on traffic analysis.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a method for security monitoring of cross-border data transmission based on traffic analysis, comprising the following steps:

[0008] S1: Collect data packets from cross-border network exit nodes and traffic collection devices, extract source address, destination address, source port, destination port, protocol type, timestamp, and communication direction, and write them into the memory module in chronological order to obtain the exit message sequence;

[0009] S2: Based on the outgoing message sequence, call the IP address segment tables in the telecom operator gateway and the enterprise outgoing gateway to complete the address segment mapping and register the interval number and country code to obtain the address segment ownership list;

[0010] S3: Based on the address range attribution list, call the real-time traffic processing device deployed next to the cross-border network exit node and connected to the traffic collection device to identify the jump position of the same direction data packet interval, verify the country code corresponding to the previous and next address ranges, and establish a cross-border break record.

[0011] S4: For the aforementioned cross-border break record, retrieve the source address, destination address, source port, destination port, and protocol type, identify the location of parameter changes, verify the duplicate destination address, and obtain the session boundary list;

[0012] S5: Based on the session boundary list and the cross-border break record, write the session identifier, time interval and cross-border judgment status into the monitoring alarm device, merge the break point information according to the boundary range, and generate a cross-border session tag set.

[0013] Furthermore, the export message sequence includes message sequence number, arrival time, and flow direction identifier; the address range attribution list includes network address, address range, and country code; the cross-border break record includes event number, occurrence time, and flow direction identifier; the session boundary list includes boundary number, start time, and end time; and the cross-border session tag set includes session identifier, time interval, and alarm status.

[0014] Furthermore, the specific steps of S1 are as follows:

[0015] S11: Collect data packets from cross-border network exit nodes and traffic collection devices, read the source address, destination address, source port, destination port, protocol type, timestamp and communication direction of each data packet, record the number of missing items for the same collection period and fill in the null value mark according to the field position, organize the corresponding records according to the order of timestamps, and obtain the message field completeness rate.

[0016] S12: Based on the completeness rate of the message field, call the organized records, connect the timestamp sequence of each record, calculate the time difference between adjacent records, merge continuous records for the communication direction, rearrange the queue order according to the difference landing point, and obtain the time interval value.

[0017] S13: Based on the time interval value, call the rearranged queue records, write each record into the memory module in time order, check the connection position of the records before and after, divide the boundary according to the communication direction and arrange them continuously to generate the exit message sequence.

[0018] Furthermore, the specific steps of S2 are as follows:

[0019] S21: Based on the outgoing message sequence, call the IP address segment table in the telecom operator gateway and the enterprise outgoing gateway, extract the source address and destination address fields, read the address values ​​according to the segment order and perform shift accumulation, register the corresponding message identifier, and obtain the address conversion value;

[0020] S22: Based on the address conversion value, call the IP address segment table in the telecom operator gateway and the enterprise egress gateway, read the start address and end address values ​​of each address segment, compare the source address value with the destination address value one by one, record the corresponding interval number and check the dual address interval status, and obtain the interval number value.

[0021] S23: Based on the interval number value, call the IP address segment table in the telecom operator gateway and the enterprise egress gateway, extract the country code corresponding to the interval number, write it into the source address tag and destination address tag respectively, combine the interval number and country code fields according to the message identifier order, and generate the address segment ownership list.

[0022] Furthermore, the specific steps of S3 are as follows:

[0023] S31: According to the address range attribution list, call the real-time traffic processing device deployed next to the cross-border network exit node and connected to the traffic collection device, read the interval number item by item according to the data packets in the same communication direction in the cross-border communication link, calculate the difference between the previous interval number and the next interval number according to the reading order, register the corresponding previous and next positions and communication directions of each group of differences, and obtain the interval difference sequence.

[0024] S32: Based on the interval difference sequence, call the corresponding positions and communication directions of each group of differences, read the interval difference threshold, compare the difference with the interval difference threshold one by one, retain the positions that exceed the interval difference threshold and register the consecutive occurrence positions, merge and mark the first and last over-limit positions, and obtain the fracture position index.

[0025] S33: Based on the fracture location index, retrieve the country codes corresponding to the intervals before and after the fracture point, check the consistency of the character segments of the codes before and after each item, call the timestamp and communication direction corresponding to the fracture point, write the registered content into the record item in the order of the fracture point, and establish a cross-border fracture record.

[0026] Furthermore, the specific formula for calculating the difference between the interval number of the preceding term and the interval number of the following term is as follows:

[0027] ,

[0028] in, For the first Message and the first The difference in interval numbers between messages, It is an integer. For the first The address range number corresponding to each message is a positive integer or 0, where 0 indicates that no valid range was matched. For the first The address range number corresponding to each message, and its index. The current message position, index This indicates the location of the next message.

[0029] Furthermore, the specific steps of S4 are as follows:

[0030] S41: For the cross-border break record, call the source address, destination address, source port, destination port, and protocol type of the corresponding data packet, compare the fields before and after each packet in the order of the messages, write the number of changed fields in each packet into the corresponding record position, and obtain the number of changed items.

[0031] S42: Based on the number of changes, call the timestamps corresponding to the cross-border break records, merge the records of each package according to a fixed time window, calculate the difference between the total number of changes in the current window and the total number of changes in adjacent windows, register the increment corresponding to each window position, and obtain the change increment value.

[0032] S43: Based on the change increment value, select the incremental mutation position and call the destination address field of the data packets before and after, count the ratio of the number of times the same destination address appears before and after the corresponding position to the total number of data packets, verify the proportion status of the corresponding position and register the boundary positions in sequence, and establish a session boundary list.

[0033] Furthermore, the specific formula for calculating the difference between the total number of changed items in the current window and the total number of changed items in adjacent windows is as follows:

[0034] ,

[0035] in, For the first The difference in the total number of changes between each time window and the previous time window. It is an integer. For the first The cumulative value of the number of changes in all data packets within a time window, taking the range of non-negative integers. For the first Total number of changes within a time window, index The current time window number, subscript Number the previous time window.

[0036] Furthermore, the specific steps of S5 are as follows:

[0037] S51: Based on the session boundary list and the cross-border break record, call the session boundary first packet timestamp and the boundary last packet timestamp, register the session identifier, start time and end time in the order of the boundaries, and obtain the session time value;

[0038] S52: Based on the session time value, call the country code change position and break point timestamp in the cross-border break record, compare the break point timestamp with the execution interval of each session start time and end time, register the number of break points falling into the corresponding session interval and write it into the cross-border judgment status to obtain the session judgment value.

[0039] S53: Based on the session determination value, write the session identifier, start time, end time and cross-border determination status into the monitoring and alarm device connected to the real-time traffic processing device, and generate a cross-border session tag set by merging the breakpoint timestamps, country code change positions and communication directions of the data packets between each boundary.

[0040] Secondly, the present invention also provides a cross-border data transmission security monitoring system based on traffic analysis, comprising:

[0041] The message acquisition module collects data packets from cross-border network exit nodes and traffic acquisition devices, extracts source address, destination address, source port, destination port, protocol type, timestamp, and communication direction, and arranges them in chronological order to obtain the exit message sequence;

[0042] Based on the outgoing message sequence, the address attribution module calls the address segment table, performs numerical conversion between the source address and the destination address, matches the corresponding address range, registers the range number and country code, and obtains the address segment attribution list.

[0043] The break identification module calls the real-time traffic processing device based on the address range attribution list, reads the data packet interval number in the same communication direction, calculates the difference between adjacent interval numbers, filters positions that exceed the interval difference threshold, registers the country code change position, timestamp and communication direction, and establishes a cross-border break record;

[0044] For the cross-border break record, the boundary extraction module calls the corresponding data packet source address, destination address, source port, destination port and protocol type, counts the number of changes per packet, calculates the increment of the number of changes within a fixed time window, verifies the percentage of repeated destination addresses before and after, and obtains the session boundary list.

[0045] The session tagging module writes the session identifier, start time, end time and cross-border determination status according to the session boundary list and the cross-border break record, merges the break point timestamp, country code change location and communication direction, and generates a cross-border session tag set.

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0047] This invention organizes source address, destination address, port, protocol type, timestamp, and communication direction around a continuous message sequence, and associates the address conversion result with a specific interval number before associating it with the country code. The basis for cross-border determination is changed from a single point of attribution result to a continuous location change result, which can directly locate the country switching point to a specific location in the message sequence.

[0048] By combining the difference in adjacent interval numbers, the consecutive occurrence positions, and the consistency of country codes before and after, short-term address fluctuations can be distinguished from real cross-border boundaries, reducing the space for misjudgment. Furthermore, by overlaying the increase in the number of change items, the proportion of repeated destination addresses, and the merging relationship of boundary intervals, the session segmentation criteria simultaneously cover the magnitude of link changes and the stability of the access target, forming session marking results with start and end times, cross-border status, direction information, and boundary landing points. This facilitates the location of abnormal transmissions, the convergence of risk scope, and the solidification of the basis for handling. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the steps of the present invention;

[0050] Figure 2 This is a system module diagram of the present invention. Detailed Implementation

[0051] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0052] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0053] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0054] In embodiments of the present invention, sometimes the subscript is as follows: It may be written in a non-subscript form such as W1, and when the distinction is not emphasized, the meaning they express is the same.

[0055] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0056] Please see Figure 1 This invention provides a method for security monitoring of cross-border data transmission based on traffic analysis, comprising the following steps:

[0057] S1: Collect data packets from cross-border network exit nodes and traffic collection devices, extract source address, destination address, source port, destination port, protocol type, timestamp, and communication direction, write them into the memory module in chronological order and arrange them to obtain the exit message sequence;

[0058] S2: Based on the outbound message sequence, call the IP address range table in the telecom operator gateway and the enterprise outbound gateway, convert the source address and destination address into IP values ​​respectively and fall into the corresponding start address and end address range, register the range number and country code, and obtain the address range belonging list;

[0059] S3: Based on the address range attribution list, call the real-time traffic processing device deployed next to the cross-border network exit node and connected to the traffic collection device. Read the interval number of each data packet in the same communication direction in the cross-border communication link, calculate the difference between adjacent interval numbers and record the consecutive occurrence positions, select the position where the difference exceeds the threshold as the break point, retrieve the corresponding country code of the interval before and after the break point and perform consistency judgment, register the country code change position, corresponding timestamp and communication direction, and establish a cross-border break record;

[0060] S4: For cross-border break records, call the corresponding data packet source address, destination address, source port, destination port, and protocol type to compare the number of changes in each packet, count the increase in the number of changes within a fixed time window, select the incremental change position and verify the proportion of repeated destination addresses before and after, and obtain the session boundary list;

[0061] S5: Based on the session boundary list and cross-border break records, write the session identifier, start time, end time and cross-border judgment status into the monitoring and alarm device connected to the real-time traffic processing device, and generate a cross-border session tag set by merging the break point timestamp, country code change location and communication direction according to the data packet interval between each boundary.

[0062] The export message sequence includes message sequence number, arrival time, and flow direction identifier; the address range attribution list includes network address, address range, and country code; the cross-border break record includes event number, occurrence time, and flow direction identifier; the session boundary list includes boundary number, start time, and end time; and the cross-border session tag set includes session identifier, time interval, and alarm status.

[0063] The specific steps of S1 are as follows:

[0064] S11: Collect data packets from cross-border network exit nodes and traffic collection devices, read the source address, destination address, source port, destination port, protocol type, timestamp and communication direction of each data packet, record the number of missing items for the same collection period and fill in the null value mark according to the field position, organize the corresponding records according to the order of timestamps, and obtain the message field completeness rate.

[0065] First, based on the cross-border export node and the collection location, obtain the initial reference content of the data packets. For each data packet, extract the source address field, destination address field, source port field, destination port field, protocol type field, timestamp field, and communication direction field one by one. Set the number of records in a set of collection periods to N, for example, N=1000 records. For each record, check the value status of the 7 fields in the field order. Record the existence of the field as 1 and the field as 0. Obtain the field validity count value for each record. Then, sum all records in the same collection period to obtain the total number of valid fields.

[0066] For example, statistics show that... The theoretical maximum number of fields is 7 × 1000 = 7000. Therefore, the field completeness rate can be obtained through a single calculation. ,in, The message integrity rate field has a value range of [value range missing]. , This represents the total number of valid fields in all messages within a given collection period. For the first The number of valid fields in the message. This represents the theoretical maximum number of fields, derived from the number of fields in a single message (7 x total number of messages) = 1000. The range of values ​​is divided into Determined to be in the low range. It is determined to be in the middle range. It is determined to be in the high range, when If the record falls into the middle or high range, continue processing. For each record, fill in a uniform null value of -1 according to the field position. For example, if the 5th record is missing the destination port, fill in -1 at that position.

[0067] Then, all records are sorted in ascending order of timestamp value. For example, the timestamp sequence [12.001, 11.998, 12.003] is rearranged into [11.998, 12.001, 12.003]. After sorting, the correspondence between the number of fields and the number of null value markers is checked again. The completeness of each record is recalculated by the ratio of the effective field count to the total number of fields. Finally, a set of records arranged in chronological order with null value markers is formed, and the message field completeness rate is output.

[0068] S12: Based on the message field completeness rate, call the organized records, connect the timestamp sequence of each record, calculate the time difference between adjacent records, merge continuous records according to the communication direction, rearrange the queue order according to the difference landing point, and obtain the time interval value.

[0069] Based on the field completeness rate obtained in the previous section and the sorted record set, for each record, we extract two adjacent records one by one in timestamp order. and Read its timestamp and Perform the difference operation; the specific formula is as follows: ,in, For the first Message and the first The time interval between messages, in seconds, has a range of values. , The first one arranged in order of message identifier The timestamp value corresponding to each message, in seconds, is derived from the timestamp field in the original data packet. For the adjacent The timestamp value of the next message after this message, in seconds, with the index. The index of the current message's position in the sequence. This serves as the position index for the next message;

[0070] For example when and When, it is calculated according to the formula. Seconds, repeat this operation on all adjacent records to form a time difference sequence. Then, according to the communication direction field, the records are divided into inbound and outbound categories. Consecutive records in the same direction are merged, i.e., when the first... Article and No. When communication directions are consistent, they are grouped into the same group. When a direction change occurs, the current group ends and a new group begins. For example, if the direction sequence is [out, out, in, in, out], then three groups are formed. Within each segment, the Δt value is divided into intervals. Determined as a close interval, It is determined to be a normal range. If an interval is identified as sparse, the record order is rearranged based on the interval result. That is, within the same segment, records of dense intervals are arranged first, then records of regular intervals are arranged, and finally records of sparse intervals are arranged. For example, in a certain segment... If the value is [0.002, 0.0005, 0.02], then after rearranging, the corresponding record order will be adjusted to [record corresponding to 0.0005, record corresponding to 0.002, record corresponding to 0.02]. At the same time, the number of records in each segment is counted and verified against the time difference distribution. When the number of records in a segment is less than 3, the original order is maintained. When the number of records is greater than or equal to 3, the above interval sorting is performed. Finally, the record sequence arranged according to the time difference rule in each segment is obtained and the corresponding time interval value is output.

[0071] S13: Based on the timing interval value, call the rearranged queue records, write each record into the memory module in time order, check the connection position of the records before and after, divide the boundary according to the communication direction and arrange them continuously to generate the exit message sequence.

[0072] Based on the obtained time interval values ​​and the rearranged record sequence, records are read one by one and written to the preset storage area in timestamp order. The first record is used as the starting record and written to position index 1. Then, the second record is read and the difference between its timestamp and the timestamp of the first record is calculated. When the difference is... If the value is less than 0.01, it is considered a contiguous record, and the second record is written to position index 2; otherwise, a boundary marker # is inserted before writing. For example, when... At that time, insert # at position 2, then write record 2, and perform the same operation on all records in sequence. At the same time, read the communication direction field of each record. When the direction is consistent with the previous record, keep the same arrangement segment. When the direction changes, insert the direction boundary marker | at the current position. For example, if the record sequence direction is [out, out, in], then insert | between the second and third records. During the writing process, increment the position index and compare it with the total number of records. When the index value is equal to the total number of records, the writing ends. Check the entire sequence again from beginning to end to see if there are any uninserted boundary situations between adjacent records. By recalculating the adjacent time difference and the direction field, compare and correct each item, and finally obtain the exit message sequence arranged in time order and marked with time intervals and communication direction boundaries.

[0073] The specific steps of S2 are as follows:

[0074] S21: Based on the outbound message sequence, call the IP address segment table in the telecom operator gateway and the enterprise outbound gateway, extract the source address and destination address fields, read the address values ​​in segment order and perform shift accumulation, register the corresponding message identifier, and obtain the address conversion value;

[0075] First, the source address field and destination address field carried by each record in the export message sequence are used as the starting reference content. For each message, the four segments of the source address and destination address are read in sequence. For example, the source address 192.168.1.10 is split into four segments [192,168,1,10], and the destination address 10.20.5.8 is split into [10,20,5,8]. Each segment is shifted according to a fixed weight. The first segment is multiplied by 256 cubed, the second segment by 256 squared, the third segment by 256 first, and the fourth segment retains its original value. Multiplication and addition operations are performed item by item.

[0076] For example, calculating the source address yields 192×256×256×256=3221225472, 168×256×256=11010048, 1×256=256, and 10×1=10. Summing these four results gives 3232235786, which is used as the source address. Performing the same operation on the destination address yields 10×256×256×256=167772160, 20×256×256=1310720, 5×256=1280, and 8×1=8. Summing these four results gives 169084168, which is used as the destination address. For each message, the above steps of splitting, shifting, multiplying, and adding are performed. During the process, each message is assigned a unique message identifier, for example, numbered sequentially from 1 to N. When processing the 100th message, its source address conversion value and destination address conversion value are recorded and bound to message identifier 100. At the same time, the conversion value is checked for range, dividing the conversion value range into a valid range of 0 to 2^32-1. If the conversion value falls within this range, it is retained. If a negative value or exceeds 4294967295, it is marked as abnormal and set to 0. The conversion processing of all messages is completed one by one and the corresponding identifier is registered, finally obtaining the address conversion value.

[0077] S22: Based on the address conversion value, call the IP address segment table in the telecom operator gateway and the enterprise egress gateway, read the start address and end address values ​​of each address segment, compare the source address value with the destination address value one by one, record the corresponding interval number and check the dual address interval status, and obtain the interval number value.

[0078] Based on the source address and destination address conversion values ​​corresponding to each message as the starting reference, the starting and ending address values ​​of each address segment are read one by one from the address segment table. For example, the starting value of a certain address segment is 167772160 and the ending value is 184549375. A comparison operation is performed on the source address conversion value of each message. The source address conversion value is compared with the starting value of the current address segment for greater than or equal to, and with the ending value for less than or equal to. When the source address conversion value is greater than or equal to the starting value and the source address conversion value is less than or equal to the ending value, the address segment number is recorded as the source address interval number. For example, if the source address conversion value is 169084168 and meets the above conditions, the interval number is recorded as A1. The same segment-by-segment comparison operation is performed on the destination address conversion value.

[0079] For example, the destination address conversion value 3232235786 is compared with the starting value 3232235520 and the ending value 3232301055 of another address segment. When the interval condition is met, the destination address interval number is recorded as B3. During the execution process, all address segments are traversed sequentially for each message. When an address segment does not meet the above double condition judgment, the process immediately switches to the next address segment to continue the comparison. When all address segments do not meet the conditions, the interval number is recorded as 0. After obtaining the source interval number and the destination interval number for each message, a double address interval verification operation is performed, that is, the source interval number and the destination interval number are compared numerically. When both are greater than 0, it is recorded as a double valid interval state. When one of them is 0, it is recorded as a single-sided missing state. When both are 0, it is recorded as a double-sided missing state.

[0080] At the same time, the interval number is divided into numerical ranges. The number range from 1 to 1000 is defined as the valid interval number. When the number is greater than 1000 or less than 1, it is remarked as 0. The interval matching and verification process of all messages is completed one by one, and the interval number value is finally obtained.

[0081] S23: Based on the interval number value, call the IP address segment table in the telecom operator's gateway and the enterprise's egress gateway, extract the country code corresponding to the interval number, write it into the source address tag and destination address tag respectively, combine the interval number and country code fields according to the message identifier order, and generate an address segment ownership list.

[0082] Using the obtained interval number value of each message as the starting reference, the corresponding country code field is searched in the address segment table one by one according to the interval number. For example, interval number A1 corresponds to the country code US, and interval number B3 corresponds to the country code CN. For each message, the source address interval number is read first and the corresponding country code is located in the table. The country code is written into the source address tag. At the same time, the destination address interval number is read and the same search operation is performed. The corresponding country code is written into the destination address tag.

[0083] For example, if the source interval number of a message is A1, the source address tag is written as US; if the destination interval number is B3, the destination address tag is written as CN. During the execution process, the validity of the interval number is checked. When the interval number is 0, the country code is marked as UNK. Then, each message is combined according to the message identifier order. The message identifier, source interval number, source country code, destination interval number, and destination country code are arranged in a fixed order. For example, the combination corresponding to message identifier 100 is [100, A1, US, B3, CN]. This combination step is performed on all messages in sequence. At the same time, the order of the combination result is checked, that is, whether the current message identifier is greater than the previous message identifier. When a reverse order occurs, the combination result is rearranged in ascending order of the identifier. After the combination is completed, the number of fields in each record is counted and checked to see if it is 5. If it is not equal to 5, the missing field is filled in as 0 or UNK. The combination processing of all messages is completed one by one, and finally the address range attribution list is formed.

[0084] The specific steps for S3 are as follows:

[0085] S31: Based on the address range attribution list, call the real-time traffic processing device deployed next to the cross-border network exit node and connected to the traffic collection device, read the interval number item by item according to the data packets in the same communication direction in the cross-border communication link, calculate the difference between the previous interval number and the next interval number according to the reading order, register the corresponding previous and next positions and communication directions of each group of differences, and obtain the interval difference sequence.

[0086] First, using the interval numbers arranged in message identifier order in the address range attribution list and the communication direction as the starting reference, data packets in the same communication direction are grouped. Records with the communication direction field as "out" are grouped together, and records with the communication direction field as "in" are grouped together. Within each group, the interval number values ​​are read one by one in message identifier order. For example, if a certain interval number sequence is [15,18,20,19,25], the difference operation is performed between the i-th item and the (i+1)-th item in the sequence. The formula is: ,in, For the first Message and the first The difference in interval numbers between messages, It is an integer. For the first The address range number corresponding to each message is a positive integer or 0, where 0 indicates that no valid range was matched. For the first The address range number corresponding to each message, and its index. The current message position, index Position for the next message;

[0087] For example, the difference between 15 and 18 is 3, the difference between 18 and 20 is 2, the difference between 20 and 19 is -1, and the difference between 19 and 25 is 6. Each difference is bound to its corresponding preceding and following position indices; for example, difference 3 corresponds to position (1,2), and difference 2 corresponds to position (2,3). The communication direction of this group is also recorded as out. During execution, the difference values ​​are divided into intervals, and the absolute value of the difference is... Determined to be in a low-volatility range. It is determined to be in the medium range of variation. The interval is determined to be of high variation. For example, a difference of 3 belongs to the middle interval and a difference of 6 belongs to the high interval. For each difference, its interval category and position index are recorded, and the sequence length is counted. When the sequence length is less than 2, the difference calculation is not performed. When the sequence length is greater than or equal to 2, the difference calculation and registration operation are performed item by item. At the same time, each group of processing results is written back according to the original message identifier order to form a record set with three pieces of information: difference, position index and communication direction. For example, [(1,2,3,out),(2,3,2,out),(3,4,-1,out),(4,5,6,out)] is obtained. The above operation is repeated for all communication directions, and the interval difference sequence is obtained by summarizing.

[0088] S32: Based on the interval difference sequence, call the corresponding positions and communication directions of each group of differences, read the interval difference threshold, compare the difference with the interval difference threshold one by one, retain the positions that exceed the interval difference threshold and register the consecutively occurring positions, merge and mark the first and last over-limit positions, and obtain the fracture position index;

[0089] Based on each difference record in the interval difference sequence and its corresponding position and communication direction as the starting reference, an interval difference threshold is pre-set. The threshold value is determined by calculating the average and maximum values ​​of the absolute values ​​of all differences in the previous period. For example, if a sequence of absolute differences is [3, 2, 1, 6], the average value is (3+2+1+6) / 4=3, and the maximum value is 6. The threshold is then set to the midpoint between the average and the maximum value. Perform a comparison operation on each difference record and convert the absolute value of the difference to the absolute value of the difference. With threshold When comparing, The system records the position as an out-of-limit position. For example, if the difference is 6, then the corresponding position (4,5) is recorded as out of limit. This comparison process is performed on all records one by one to form a set of out-of-limit positions, such as [(4,5)]. When there are multiple out-of-limit positions, the position index is judged as continuous. Adjacent position indexes with a difference of 1 are judged as continuous. For example, positions (4,5) and (5,6) are judged as continuous. The positions that appear continuously are merged. The first position index and the last position index are combined into a range label. For example, the continuous positions (4,5), (5,6), and (6,7) are merged into (4,7). During the execution, the communication direction within each position group is checked for consistency. When the direction field is consistent, the merged result is retained. When the direction field is inconsistent, it is split into multiple independent ranges. At the same time, the number of out-of-limit positions is counted. When the number is 0, an empty result is output directly. When the number is greater than 0, the above merging process is performed. Finally, the broken position indexes are obtained in order.

[0090] S33: Based on the fracture location index, retrieve the country codes corresponding to the intervals before and after the fracture point, check the consistency of the character segments of the codes before and after each item, call the timestamp and communication direction corresponding to the fracture point, write the registration content of each item into the record item in the order of the fracture point, and establish a cross-border fracture record.

[0091] Using the break location index and corresponding message location as the starting reference, each break interval is read one by one, and the interval number corresponding to the previous and next positions is read. Then, the corresponding country code field is found through the interval number. For example, the break location (4,7) corresponds to the country code US with the previous interval number 20 and the country code CN with the next interval number 35. The two country code strings are compared character by character, and the characters are split into single character sequences in order. For example, US is split into [U,S] and CN is split into [C,N]. The corresponding characters are compared one by one to see if they are equal. When all characters are not equal, it is determined to be a completely different state. When at least one character is equal, it is determined to be a partially consistent state. When all characters are equal, it is determined to be a completely consistent state.

[0092] Simultaneously, record the timestamp values ​​corresponding to the breakpoints. For example, position 4 corresponds to timestamp 12.001, and position 7 corresponds to timestamp 12.015. Calculate the timestamp difference as 0.014 and register it together with the communication direction field. Write the above country code comparison results, timestamp difference, communication direction, and breakpoint index into the record item in order, for example, forming the record [4,7,US,CN,complete difference,0.014,out]. During the execution process, repeat the above reading, splitting, character comparison, and registration operations for all break intervals in sequence. At the same time, verify the number of record item fields. When the number of fields is less than 7, supplement with the default value 0 or UNK. Sort all records in ascending order according to the breakpoint starting index. Complete the registration process of all breakpoints one by one to establish a cross-border break record.

[0093] The specific steps of S4 are as follows:

[0094] S41: For cross-border break records, call the source address, destination address, source port, destination port, and protocol type of the corresponding data packet, compare the fields before and after each packet in the order of the messages, write the number of changed fields in each packet to the corresponding record position, and obtain the number of changed items.

[0095] First, using the data packet fields corresponding to each record in the cross-border break record as the starting reference, read the source address field, destination address field, source port field, destination port field, and protocol type field one by one, and then sort them according to the message identifier order. record and number Each record undergoes a field-by-field comparison. The source address field is compared bit-by-bit, either string-wise or numerically. A value of 0 is recorded if two records have identical source addresses, and a value of 1 is recorded if any part of the value is unequal. The same bit-by-bit comparison is performed on the destination address field, and the results are recorded. The source and destination port fields are directly compared for numerical equality; a value of 0 is recorded if the two values ​​are equal, and a value of 1 is recorded if they are not equal. The protocol type field is compared for encoded values; for example, TCP is recorded as 6, and UDP as 17. A value of 0 is recorded if the encoded values ​​are the same, and a value of 1 is recorded if they are different. The results of these five comparisons are summed to obtain the number of changed items. ,in, For the first Message and the first The number of fields that changed between messages. The field comparison result is a 0 or 1 value obtained after comparing the source address, destination address, source port, destination port, and protocol type respectively. Subscript This is the current message position. The value is an integer between 0 and 5;

[0096] For example, if the comparison result of two records is [1,0,1,0,1], then the sum is... During execution, the quantity values ​​of the variable items are divided into intervals. It was determined to be an area with no change. Values ​​of 1 to 2 are considered to be in the low-change range. Values ​​between 3 and 4 are considered to be in the medium range of variation. If a region is identified as having high volatility, the number of changes for each record is written to the corresponding record location and a message identifier is bound to it. For example, after comparing record 50 with record 51, the result is... And it is recorded in record 50. The above field comparison and accumulation operations are performed on all adjacent messages one by one. When the total number of records is N, N-1 comparison processes are completed, and the validity of each calculation result is checked. When the value is less than 0 or greater than 5, the comparison result of the corresponding field is recalculated to obtain the number of changed items.

[0097] S42: Based on the number of change items, call the timestamps corresponding to the cross-border break records, merge the records of each package according to a fixed time window, calculate the difference between the total number of change items in the current window and the total number of change items in adjacent windows, register the increment corresponding to the position of each window, and obtain the change increment value;

[0098] A fixed time window length is set based on the number of changes obtained for each record and its corresponding timestamp. For example, take For each second, divide all records into multiple consecutive window intervals according to their timestamps from smallest to largest. For each window, sum the number of changed items. For example, if a window contains 5 records with changed item counts of [2, 1, 3, 0, 2], then the total number of changed items for that window is 2 + 1 + 3 + 0 + 2 = 8. Record this result as the total number of changes for the window. Then, calculate the difference between adjacent windows using the following formula: ,in, For the first The difference in the total number of changes between each time window and the previous time window. For the first The cumulative value of the number of changes in all data packets within a time window, taking the range of non-negative integers. For the first Total number of changes within a time window, index The current time window number, subscript Number the previous time window;

[0099] For example, if the previous window had a total of 5 windows and the current window has a total of 8 windows, then the difference is... During execution, the difference is divided into intervals. It is determined to be in a downward range. It was determined to be in a stable range. Once the range is determined to be increasing, the windows are numbered sequentially (e.g., window 1, window 2, window 3). For each window, the total change and the difference are recorded, and the difference is linked to the window position. For example, it is recorded as follows: When dividing the window, a comparison operation is performed on the timestamps. satisfy start time and The end time is assigned to the current window; otherwise, it is assigned to the next window. The total number of changes and the difference between adjacent windows are calculated for each window one by one, and the results are checked for range. When the absolute value of the difference exceeds the preset upper limit, such as 10, it is marked as abnormal and set to 10. Finally, the change increment value is obtained.

[0100] S43: Based on the change increment value, select the incremental mutation position and call the destination address field of the data packets before and after, count the ratio of the number of times the same destination address appears before and after the corresponding position to the total number of data packets, verify the proportion status of the corresponding position and register the boundary positions in sequence, and establish a session boundary list;

[0101] Using the incremental change value and window position corresponding to each window as the starting reference, a threshold for determining incremental mutations is set. For example, take The incremental value of the change for each window Perform a comparison operation when The position of this window is recorded as the mutation position, for example... Then window 3 is marked. For each mutation position, the data packet set corresponding to the previous and next windows is read, the destination address field of all data packets is extracted, and the destination addresses in the previous window are counted one by one to record the number of times the same address appears.

[0102] For example, if an address appears 3 times and the total number of data packets is 5, the calculated percentage is 3 / 5 = 0.6. The same statistics are performed on the next window to obtain the percentage value, for example, 1 / 5 = 0.2. The percentage value is divided into intervals. When the percentage is ≥ 0.7, it is determined to be a high concentration interval; when the percentage is ≤ 0.3 and the percentage is < 0.7, it is determined to be a medium concentration interval; and when the percentage is < 0.3, it is determined to be a low concentration interval. The percentage status of the previous and next windows is compared. When the current window is in a high concentration interval and the next window is in a low concentration interval, it is recorded as a significant change position. When both are in the medium or low interval, it is recorded as a general change position. At the same time, the mutation position index is bound and registered with the corresponding previous and next percentage status, for example, recorded as (window 3, 0.6, 0.2). During the execution, the above statistical and interval judgment operations are performed on all mutation windows one by one, and all mutation positions are arranged in order of window number. A boundary marker is generated for each position and written into the list. At the same time, the number of list items is counted and verified. When the record item is missing percentage data, the statistical steps are re-executed to complete it. Finally, a session boundary list is formed in order.

[0103] The specific steps of S5 are as follows:

[0104] S51: Based on the session boundary list and cross-border break records, call the session boundary first packet timestamp and boundary last packet timestamp, register the session identifier, start time and end time in the order of the boundaries, and obtain the session time value;

[0105] First, using the registered boundary locations in the session boundary list and the corresponding message identifiers in the cross-border break records as the starting references, the first and last packet positions corresponding to each session boundary are read one by one. The first and last packet timestamps are extracted from the corresponding packets. For example, if the first packet timestamp of a session is 10.002 and the last packet timestamp is 10.128, these timestamps are read and written into the record entries in sequence. Simultaneously, a unique session identifier ID is assigned to each session, for example, numbered S1, S2, and S3 in sequence. The time difference is calculated for each session by subtracting the end time from the start time to obtain the session duration. The formula is: ,in, This represents the duration of a single session, in seconds, with a range of values. , This is the start timestamp of the session, corresponding to the timestamp of the first packet at the session boundary. This is the end timestamp of the session, corresponding to the timestamp of the tail packet in the session boundary, with the index... The time parameter corresponding to the session identifier;

[0106] For example, 10.128 − 10.002 = 0.126. This value is used as the session time value and recorded under the corresponding session identifier. During execution, the time value is divided into intervals. Determined as a short-term interval, Determined to be in the middle time zone. If a time interval is determined to be long, for example, 0.126 is determined to be a long time interval. At the same time, all sessions are sorted according to the boundary order, that is, sorted by start time from smallest to largest. If two sessions have the same start time, they are sorted by end time from smallest to largest. The number of fields in each session record is checked. If there is a missing timestamp, it is extracted and supplemented from the corresponding message. The identifier allocation, time reading and difference calculation are completed for each session one by one to finally obtain the session time value.

[0107] S52: Based on the session time value, call the country code change position and breakpoint timestamp in the cross-border break record, compare the breakpoint timestamp with the execution interval of each session start time and end time, register the number of breakpoints falling into the corresponding session interval and write it into the cross-border judgment status to obtain the session judgment value.

[0108] Based on the start and end times of each session, as well as the timestamps and country code changes in the cross-border break records, as the initial reference content, each break point timestamp... Perform an interval comparison operation, and Each session start time and end time Compare, when satisfied The breakpoint is determined to fall within the session interval.

[0109] For example, if a session's interval is [10.002, 10.128] and the breakpoint timestamp is 10.050, then the condition is met, and this breakpoint is included in the session. For each session, the number of breakpoints n_b is counted. For example, if 3 breakpoints are counted in a session, the number of country code changes corresponding to these breakpoints is read and a consistency count is performed. When the number of changes matches the number of breakpoints, it is marked as complete; when there is a discrepancy, it is marked as incomplete. During execution, the number of breakpoints is divided into intervals. The area was determined to be without fractures. Values ​​of 1 to 2 are considered to be in the low fracture range. Values ​​between 3 and 5 are considered to be within the intermediate fracture range. Determined as a high-fracture zone, for example If a session is identified as a break interval, the session interval, the number of break points, and the status of the interval are written into the corresponding record. The change position of the country code is checked item by item. If the country codes of adjacent break points are different, the change count is incremented by 1. The number of break points and the change count are written into the session record. The above interval comparison and statistical processing are repeated for all sessions to obtain the session determination value.

[0110] S53: Based on the session determination value, write the session identifier, start time, end time and cross-border determination status into the monitoring and alarm device connected to the real-time traffic processing device, and generate a cross-border session tag set by merging the breakpoint timestamps, country code change locations and communication directions of the data packets between each boundary;

[0111] The session identifier, start time, end time, and session judgment value corresponding to each session are used as the starting reference content. The above fields are written into the corresponding record area of ​​the monitoring and alarm device one by one. The data packet interval between the session boundary is merged. All data packet positions in each session interval are traversed to extract the corresponding breakpoint timestamp, country code change position, and communication direction field. For example, if a session contains data packet positions [20 to 50], then all breakpoints in the interval are filtered and their timestamp set is recorded as [10.050, 10.072, 10.110].

[0112] Simultaneously, the corresponding country code change positions, such as [US→CN, CN→JP], and communication directions, such as [out, out, in], are extracted. These fields are then sorted sequentially and bound to the current session identifier. The fields are combined to form record items, such as [S1, 10.002, 10.128, 3, 10.050, US→CN, out]. During execution, the number of breakpoints within each session is counted and compared with the statistical value of the previous stage. If the number is inconsistent, the filtering step is re-executed. At the same time, the consistency of the communication direction field is checked. If the direction is inconsistent within the same session, the record is split according to the direction change position. All record items are sorted in ascending order by session identifier and timestamp. The number of record item fields is validated. If there are insufficient fields, default values ​​of 0 or UNK are added. The merging and registration operation of all session intervals is completed one by one to generate a cross-border session tag set.

[0113] Please see Figure 2 A cross-border data transmission security monitoring system based on traffic analysis includes:

[0114] The message acquisition module collects data packets from cross-border network exit nodes and traffic acquisition devices, extracts source address, destination address, source port, destination port, protocol type, timestamp, and communication direction, and arranges them in chronological order to obtain the exit message sequence;

[0115] The address attribution module, based on the outbound message sequence, calls the address segment table, performs numerical conversion between the source and destination addresses, matches the corresponding address ranges, registers the range number and country code, and obtains the address segment attribution list.

[0116] The break identification module calls the real-time traffic processing device based on the address range attribution list, reads the data packet interval number in the same communication direction, calculates the difference between adjacent interval numbers, filters positions that exceed the interval difference threshold, registers the country code change position, timestamp and communication direction, and establishes a cross-border break record;

[0117] The boundary extraction module targets cross-border break records by calling the source address, destination address, source port, destination port, and protocol type of the corresponding data packets, counting the number of changes per packet, calculating the increment of the number of changes within a fixed time window, verifying the percentage of repeated destination addresses before and after verification, and obtaining a session boundary list.

[0118] The session tagging module writes the session identifier, start time, end time and cross-border judgment status according to the session boundary list and cross-border break records, merges the break point timestamp, country code change location and communication direction, and generates a cross-border session tag set.

[0119] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for security monitoring of cross-border data transmission based on traffic analysis, characterized in that, Includes the following steps: S1: Collect data packets from cross-border network exit nodes and traffic collection devices, extract source address, destination address, source port, destination port, protocol type, timestamp, and communication direction, and write them into the memory module in chronological order to obtain the exit message sequence; S2: Based on the outgoing message sequence, call the IP address segment tables in the telecom operator gateway and the enterprise outgoing gateway to complete the address segment mapping and register the interval number and country code to obtain the address segment ownership list; S3: Based on the address range attribution list, call the real-time traffic processing device deployed next to the cross-border network exit node and connected to the traffic collection device to identify the jump position of the same direction data packet interval, verify the country code corresponding to the previous and next address ranges, and establish a cross-border break record. S4: For the aforementioned cross-border break record, retrieve the source address, destination address, source port, destination port, and protocol type, identify the location of parameter changes, verify the duplicate destination address, and obtain the session boundary list; S5: Based on the session boundary list and the cross-border break record, write the session identifier, time interval and cross-border judgment status into the monitoring alarm device, merge the break point information according to the boundary range, and generate a cross-border session tag set.

2. The cross-border data transmission security monitoring method based on traffic analysis according to claim 1, characterized in that, The export message sequence includes message sequence number, arrival time, and flow direction identifier; the address range attribution list includes network address, address range, and country code; the cross-border break record includes event number, occurrence time, and flow direction identifier; the session boundary list includes boundary number, start time, and end time; and the cross-border session tag set includes session identifier, time interval, and alarm status.

3. The cross-border data transmission security monitoring method based on traffic analysis according to claim 1, characterized in that, The specific steps of S1 are as follows: S11: Collect data packets from cross-border network exit nodes and traffic collection devices, read the source address, destination address, source port, destination port, protocol type, timestamp and communication direction of each data packet, record the number of missing items for the same collection period and fill in the null value mark according to the field position, organize the corresponding records according to the order of timestamps, and obtain the message field completeness rate. S12: Based on the completeness rate of the message field, call the organized records, connect the timestamp sequence of each record, calculate the time difference between adjacent records, merge continuous records for the communication direction, rearrange the queue order according to the difference landing point, and obtain the time interval value. S13: Based on the time interval value, call the rearranged queue records, write each record into the memory module in time order, check the connection position of the records before and after, divide the boundary according to the communication direction and arrange them continuously to generate the exit message sequence.

4. The cross-border data transmission security monitoring method based on traffic analysis according to claim 1, characterized in that, The specific steps of S2 are as follows: S21: Based on the outgoing message sequence, call the IP address segment table in the telecom operator gateway and the enterprise outgoing gateway, extract the source address and destination address fields, read the address values ​​according to the segment order and perform shift accumulation, register the corresponding message identifier, and obtain the address conversion value; S22: Based on the address conversion value, call the IP address segment table in the telecom operator gateway and the enterprise egress gateway, read the start address and end address values ​​of each address segment, compare the source address value with the destination address value one by one, record the corresponding interval number and check the dual address interval status, and obtain the interval number value. S23: Based on the interval number value, call the IP address segment table in the telecom operator gateway and the enterprise egress gateway, extract the country code corresponding to the interval number, write it into the source address tag and destination address tag respectively, combine the interval number and country code fields according to the message identifier order, and generate the address segment ownership list.

5. The cross-border data transmission security monitoring method based on traffic analysis according to claim 1, characterized in that, The specific steps of S3 are as follows: S31: According to the address range attribution list, call the real-time traffic processing device deployed next to the cross-border network exit node and connected to the traffic collection device, read the interval number item by item according to the data packets in the same communication direction in the cross-border communication link, calculate the difference between the previous interval number and the next interval number according to the reading order, register the corresponding previous and next positions and communication directions of each group of differences, and obtain the interval difference sequence. S32: Based on the interval difference sequence, call the corresponding positions and communication directions of each group of differences, read the interval difference threshold, compare the difference with the interval difference threshold one by one, retain the positions that exceed the interval difference threshold and register the consecutive occurrence positions, merge and mark the first and last over-limit positions, and obtain the fracture position index. S33: Based on the fracture location index, retrieve the country codes corresponding to the intervals before and after the fracture point, check the consistency of the character segments of the codes before and after each item, call the timestamp and communication direction corresponding to the fracture point, write the registered content into the record item in the order of the fracture point, and establish a cross-border fracture record.

6. The cross-border data transmission security monitoring method based on traffic analysis according to claim 5, characterized in that, The specific formula for calculating the difference between the interval number of the preceding term and the interval number of the following term is as follows: ， in, For the first Message and the first The difference in interval numbers between messages, It is an integer. For the first The address range number corresponding to each message is a positive integer or 0, where 0 indicates that no valid range was matched. For the first The address range number corresponding to each message, and its index. The current message position, index This indicates the location of the next message.

7. The cross-border data transmission security monitoring method based on traffic analysis according to claim 1, characterized in that, The specific steps of S4 are as follows: S41: For the cross-border break record, call the source address, destination address, source port, destination port, and protocol type of the corresponding data packet, compare the fields before and after each packet in the order of the messages, write the number of changed fields in each packet into the corresponding record position, and obtain the number of changed items. S42: Based on the number of changes, call the timestamps corresponding to the cross-border break records, merge the records of each package according to a fixed time window, calculate the difference between the total number of changes in the current window and the total number of changes in adjacent windows, register the increment corresponding to each window position, and obtain the change increment value. S43: Based on the change increment value, select the incremental mutation position and call the destination address field of the data packets before and after, count the ratio of the number of times the same destination address appears before and after the corresponding position to the total number of data packets, verify the proportion status of the corresponding position and register the boundary positions in sequence, and establish a session boundary list.

8. The cross-border data transmission security monitoring method based on traffic analysis according to claim 7, characterized in that, The specific formula for calculating the difference between the total number of changed items in the current window and the total number of changed items in adjacent windows is as follows: in, For the first The difference in the total number of changes between each time window and the previous time window. It is an integer. The cumulative value of the number of changes in all data packets, taking the range of non-negative integers. Total number of changes, subscript The current time window number, subscript Number the previous time window.

9. The cross-border data transmission security monitoring method based on traffic analysis according to claim 1, characterized in that, The specific steps of S5 are as follows: S51: Based on the session boundary list and the cross-border break record, call the session boundary first packet timestamp and the boundary last packet timestamp, register the session identifier, start time and end time in the order of the boundaries, and obtain the session time value; S52: Based on the session time value, call the country code change position and break point timestamp in the cross-border break record, compare the break point timestamp with the execution interval of each session start time and end time, register the number of break points falling into the corresponding session interval and write it into the cross-border judgment status to obtain the session judgment value. S53: Based on the session determination value, write the session identifier, start time, end time and cross-border determination status into the monitoring and alarm device connected to the real-time traffic processing device, and generate a cross-border session tag set by merging the breakpoint timestamps, country code change positions and communication directions of the data packets between each boundary.

10. A cross-border data transmission security monitoring system based on traffic analysis, used to implement the cross-border data transmission security monitoring method based on traffic analysis as described in any one of claims 1-9, characterized in that, include: The message acquisition module collects data packets from cross-border network exit nodes and traffic acquisition devices, extracts source address, destination address, source port, destination port, protocol type, timestamp, and communication direction, and arranges them in chronological order to obtain the exit message sequence; Based on the outgoing message sequence, the address attribution module calls the address segment table, performs numerical conversion between the source address and the destination address, matches the corresponding address range, registers the range number and country code, and obtains the address segment attribution list. The break identification module calls the real-time traffic processing device based on the address range attribution list, reads the data packet interval number in the same communication direction, calculates the difference between adjacent interval numbers, filters positions that exceed the interval difference threshold, registers the country code change position, timestamp and communication direction, and establishes a cross-border break record; For the cross-border break record, the boundary extraction module calls the corresponding data packet source address, destination address, source port, destination port and protocol type, counts the number of changes per packet, calculates the increment of the number of changes within a fixed time window, verifies the percentage of repeated destination addresses before and after, and obtains the session boundary list. The session tagging module writes the session identifier, start time, end time and cross-border determination status according to the session boundary list and the cross-border break record, merges the break point timestamp, country code change location and communication direction, and generates a cross-border session tag set.

Images