A network security monitoring and response method and system based on traffic analysis

Abstract

The application relates to the technical field of network security, and particularly discloses a network security monitoring and response method and system based on traffic analysis, which comprises the following steps: capturing an instruction flow to construct a time-sequenced instruction sequence; extracting a first-order change feature, a second-order change feature and a randomness measurement value of an instruction type sequence of continuous instructions, and merging the features into a risk feature vector; comparing the risk feature vector with a baseline feature library, and generating a risk early warning signal when a deviation degree exceeds a preset threshold; generating a dynamic access rule in response to the signal, and blocking a subsequent instruction flow originating from a source identifier within a short time window; monitoring the subsequent instruction flow within the time window, and canceling or continuing the dynamic access rule according to a backfall or continuous deviation of the risk feature vector; and the application can realize predictive blocking and adaptive adjustment of abnormal instruction flow, and effectively eliminate the technical defects that malicious instructions have been executed due to response delay.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a network security monitoring and response method and system based on traffic analysis. Background Technology

[0002] With the development of the internet, the deep integration of control systems and information networks has led to increasingly severe cybersecurity threats facing previously closed network environments. Traditional control network security protection methods mainly rely on firewalls deployed at the perimeter or signature-based intrusion detection systems. These methods identify threats by matching known attack characteristics.

[0003] In network control environments, how can we break through the limitations of traditional network security protection solutions that rely on single instruction feature matching and serial processing architecture, and construct risk characteristics from two dimensions: the numerical change trend of instruction sequence and the uncertainty of instruction distribution? This would allow us to advance the response time from "post-event blocking" after malicious instructions have been executed to "predictive intervention" when abnormal trends in instruction sequences first appear, thereby eliminating the core defect of the "response window" caused by the inability of second-level response delays to match millisecond-level instruction execution cycles in existing technologies. Summary of the Invention

[0004] The purpose of this invention is to provide a network security monitoring and response method and system based on traffic analysis to solve the problems mentioned above.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A network security monitoring and response method based on traffic analysis includes the following steps:

[0007] S1: Capture the instruction stream in the network, extract the timing and numerical information of each instruction, and construct a time-sorted instruction sequence as a set of instruction sequences to be analyzed;

[0008] S2: Based on the instruction sequence set, extract the numerical change parameters of continuous instructions to obtain the first-order and second-order change features that reflect the trend of numerical change. At the same time, measure the randomness of the instruction type sequence to obtain the randomness measure value that reflects the uncertainty of instruction distribution. Combine the first-order change features, second-order change features and randomness measure value into a risk feature vector.

[0009] S3: Compare the risk feature vector with the preset baseline feature library. The baseline feature library consists of risk feature vectors of historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated.

[0010] S4: In response to the risk warning signal, generate dynamic access rules in the communication session corresponding to the source identifier. The dynamic access rules are configured to block subsequent command streams originating from the source identifier within a preset short time window, and distribute the dynamic access rules to the network forwarding nodes.

[0011] S5: Monitor subsequent instruction flows within a short time window. When the risk feature vector of the subsequent instruction flow falls back to the threshold range of the baseline feature library, cancel the dynamic access rule; when the risk feature vector of the subsequent instruction flow continues to deviate from the baseline feature library, extend the effective time window of the dynamic access rule.

[0012] As a further aspect of the present invention: S2 specifically includes:

[0013] Extract the numerical information of two consecutive instructions from the instruction sequence set, calculate the numerical difference between the next instruction and the previous instruction as the first-order change feature, and calculate the difference between the current first-order change feature and the previous first-order change feature as the second-order change feature.

[0014] Extract the type information of each instruction in the preset sliding window from the instruction sequence set, count the frequency of occurrence of different instruction types in the sliding window, and calculate the randomness measure based on the frequency of occurrence of each instruction type and the total number of instructions in the sliding window;

[0015] The first-order variation features, second-order variation features, and randomness measures are concatenated after being aligned with time to form a risk feature vector.

[0016] As a further aspect of the present invention: the calculation of the randomness metric specifically includes:

[0017] Extract all instructions within the current sliding window from the instruction sequence set, extract the type information of each instruction, count the frequency of each instruction type in the sliding window, and use the ratio of the frequency of each instruction type to the total number of instructions in the sliding window as the normalized frequency of the instruction type.

[0018] The normalized frequencies of each instruction type within the sliding window are multiplied, and the reciprocal of the product is multiplied by the total number of instructions within the sliding window to obtain a randomness measure.

[0019] As a further aspect of the present invention: S3 specifically includes:

[0020] Obtain the timestamp information corresponding to the risk feature vectors, and extract historical risk feature vectors within the same time window from the baseline feature library based on the timestamp information to form a comparison vector set;

[0021] Calculate the vector distance between the risk feature vector and each historical risk feature vector in the comparison vector set, sort the vector distances, and select the smallest distance value in the sort as the deviation metric.

[0022] The deviation metric is compared with a preset deviation threshold. When the deviation metric is greater than the deviation threshold, it is determined that the degree of deviation of the risk feature vector from the baseline feature library exceeds the preset threshold, and a risk warning signal containing the source identifier is generated.

[0023] As a further aspect of the present invention: S4 specifically includes:

[0024] Analyze the risk warning signal, extract the source identifier and the session identifier of the communication session corresponding to the source identifier, and determine the network forwarding nodes through which the communication session flows;

[0025] The matching conditions are generated based on the source identifier, and the effective time period is generated based on the preset short time window. The matching conditions are associated with the blocking action and embedded into the effective time period to form dynamic access rules.

[0026] The dynamic access rules are encapsulated into an instruction format that matches the control interface of the network forwarding node. Instructions carrying the dynamic access rules are sent to the network forwarding node, so that the network forwarding node blocks the instruction stream that matches the conditions during the effective period.

[0027] As a further aspect of the present invention: the dynamic access rules specifically include:

[0028] Obtain the source identifier and extract the risk level information corresponding to the source identifier from the risk warning signal. Select one of the preset time window lengths as the short time window based on the risk level information.

[0029] Based on the source identifier and the high-risk instruction types parsed in the communication session, generate matching conditions that include source address matching items and instruction type matching items;

[0030] The matching conditions, blocking actions, and short-term time windows are encapsulated into dynamic access rules in the form of triples, and a rule identifier is assigned to the dynamic access rules. The rule identifier is then associated with and stored with the risk warning signal.

[0031] As a further aspect of the present invention: the generation of matching conditions including source address matching items and instruction type matching items specifically includes:

[0032] Parse the source identifier, extract the network layer address as the source address matching item, and extract the application layer identity identifier as a supplementary matching item based on the authentication information already established in the communication session corresponding to the source identifier.

[0033] Obtain the high-risk instruction types that have been parsed in the communication session, and match the instruction function code range corresponding to the high-risk instruction type from the preset high-risk instruction feature library as the instruction type matching item;

[0034] The source address match, supplementary match, and instruction type match are combined in a hierarchical nesting manner to construct a matching condition with multiple levels of matching priority.

[0035] As a further aspect of the present invention: the revocation of dynamic access rules specifically includes:

[0036] Within a short time window, continuously capture subsequent instruction streams originating from the source identifier, extract the numerical and type information of each instruction in the subsequent instruction stream, and calculate the current risk feature vector of the subsequent instruction stream.

[0037] The current risk feature vector is compared with the baseline feature library to obtain the current deviation measure. The current deviation measure is then compared with the preset safety fallback threshold. If the safety fallback threshold is lower than the preset threshold, then the current deviation measure is compared with the preset safety fallback threshold.

[0038] When the current deviation metric is less than the safety fallback threshold, a revocation command carrying the rule identifier of the dynamic access rule is generated and sent to the network forwarding node, causing the network forwarding node to delete the dynamic access rule.

[0039] As a further aspect of the present invention: the process of continuing the dynamic access rules specifically includes:

[0040] Monitor the end time of the short time window, and when the end time arrives, obtain the subsequent instruction stream originating from the source identifier within the short time window, and calculate the cumulative risk feature vector of the subsequent instruction stream within the short time window;

[0041] The cumulative risk feature vector is compared with the baseline feature library to obtain the cumulative deviation measure, and the cumulative deviation measure is compared with a preset threshold.

[0042] When the cumulative deviation metric value continues to exceed the preset threshold, a continuation rule is generated. The continuation rule is configured to continue blocking subsequent instruction streams originating from the source identifier within the continuation time window, and the continuation rule is sent to the network forwarding node. At the same time, the continuation rule is associated with and stored with the dynamic access rule.

[0043] A network security monitoring and response system based on traffic analysis, comprising:

[0044] The instruction sequence construction module captures the instruction stream in the network, extracts the timing and numerical information of each instruction, and constructs an instruction sequence sorted by time as a set of instruction sequences to be analyzed.

[0045] The risk feature extraction module extracts the numerical change parameters of continuous instructions based on the instruction sequence set, and obtains the first-order and second-order change features that reflect the trend of numerical change. At the same time, it measures the randomness of the instruction type sequence to obtain the randomness measure value that reflects the uncertainty of instruction distribution. The first-order change features, second-order change features and randomness measure value are combined into a risk feature vector.

[0046] The risk identification and early warning module compares the risk feature vector with a preset baseline feature library, which consists of risk feature vectors of historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated.

[0047] The dynamic policy generation module, in response to the risk warning signal, generates dynamic access rules in the communication session corresponding to the source identifier. The dynamic access rules are configured to block subsequent command streams originating from the source identifier within a preset short time window, and then distribute the dynamic access rules to the network forwarding nodes.

[0048] The policy execution and adaptive adjustment module monitors subsequent instruction flows within a short time window. When the risk feature vector of the subsequent instruction flow falls back to the threshold range of the baseline feature library, the dynamic access rule is revoked; when the risk feature vector of the subsequent instruction flow continues to deviate from the baseline feature library, the effective time window of the dynamic access rule is extended.

[0049] The beneficial effects of this invention are:

[0050] (1) By extracting the first-order change features, second-order change features and randomness measure of the instruction sequence to construct a risk feature vector, and by using the baseline feature library established based on the historical normal instruction sequence to determine the deviation, it is possible to identify abnormal trends and generate early warning signals before the malicious instruction sequence is fully executed. This advances the response time from "after the malicious instruction has reached the execution device" in the traditional scheme to "the early stage of the formation of the abnormal trend of the instruction sequence", effectively eliminating the technical defect in network control scenarios where the malicious instruction has been executed due to response delay.

[0051] (2) By generating dynamic access rules with short time windows and continuously monitoring subsequent command flows within the time window, the dynamic access rules are adaptively revoked or extended based on changes in the risk feature vector, achieving precise isolation and rapid recovery of abnormal source identifiers. Simultaneously, the hierarchical nesting structure of matching conditions is dynamically adjusted through confidence calculation. At high confidence levels, the application layer identity identifier is retained as a supplementary matching item to improve rule accuracy; at low confidence levels, the supplementary matching item is removed to reduce the risk of rule failure. This minimizes interference with normal network command flows while ensuring effective security protection. Attached Figure Description

[0052] The invention will now be further described with reference to the accompanying drawings.

[0053] Figure 1 This is a flowchart of the method of the present invention;

[0054] Figure 2 This is a system block diagram of the present invention. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Please see Figure 1 As shown, this invention is a network security monitoring and response method based on traffic analysis, comprising the following steps:

[0057] S1: Capture the instruction stream in the network, extract the timing and numerical information of each instruction, and construct a time-sorted instruction sequence as a set of instruction sequences to be analyzed;

[0058] S2: Based on the instruction sequence set, extract the numerical change parameters of continuous instructions to obtain the first-order and second-order change features that reflect the trend of numerical change. At the same time, measure the randomness of the instruction type sequence to obtain the randomness measure value that reflects the uncertainty of instruction distribution. Combine the first-order change features, second-order change features and randomness measure value into a risk feature vector.

[0059] S3: Compare the risk feature vector with the preset baseline feature library. The baseline feature library consists of risk feature vectors of historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated.

[0060] S4: In response to the risk warning signal, generate dynamic access rules in the communication session corresponding to the source identifier. The dynamic access rules are configured to block subsequent command streams originating from the source identifier within a preset short time window, and distribute the dynamic access rules to the network forwarding nodes.

[0061] S5: Monitor subsequent instruction flows within a short time window. When the risk feature vector of the subsequent instruction flow falls back to the threshold range of the baseline feature library, cancel the dynamic access rule; when the risk feature vector of the subsequent instruction flow continues to deviate from the baseline feature library, extend the effective time window of the dynamic access rule.

[0062] In S1, the instruction stream in the network is captured, the timing and numerical information of each instruction is extracted, and an instruction sequence ordered by time is constructed as a set of instruction sequences to be analyzed.

[0063] Deploying optical splitters or configuring port mirroring on switches on the network communication link copies the raw communication data flowing through the monitored network nodes and outputs it to the traffic acquisition probe. After receiving the raw communication data, the traffic acquisition probe bypasses the operating system kernel protocol stack using a data plane development kit, capturing network layer packets at line speed and extracting the transport layer payload. The traffic acquisition probe performs protocol parsing on the transport layer payload, identifies the control protocol type, and extracts instructions line by line from the application layer data units according to the protocol specifications. Each instruction includes at least a timestamp corresponding to the time the instruction was issued, the source identifier of the communication session to which the instruction belongs, the function code type of the instruction, and the numerical information carried by the instruction. The traffic acquisition probe sorts the instructions belonging to the same communication session according to the order of their timestamps, forming a time-sorted instruction sequence. This instruction sequence is stored in a memory buffer as a set of instruction sequences to be analyzed, for subsequent steps.

[0064] In S2, based on the instruction sequence set, numerical change parameters of consecutive instructions are extracted to obtain first-order and second-order change features reflecting the trend of numerical change. Simultaneously, the randomness of the instruction type sequence is measured to obtain a randomness measure value reflecting the uncertainty of instruction distribution. The first-order change features, second-order change features, and randomness measure value are combined into a risk feature vector, specifically including:

[0065] The set of instruction sequences to be analyzed is read from the memory buffer, and feature extraction is performed on the instruction sequences of each communication session. First, the numerical information of two consecutive instructions is extracted; the value of the latter instruction is subtracted from the value of the former instruction, and the difference is taken as the first-order change feature. Then, the current first-order change feature is extracted from the previous one; the difference is taken as the second-order change feature. When there are fewer than two consecutive instructions in the instruction sequence, the corresponding first-order change feature is set to 0; when there are fewer than two consecutive first-order change features in the instruction sequence, the corresponding second-order change feature is set to 0.

[0066] Simultaneously, a randomness measurement operation is performed on the instruction sequence. A sliding window length of 10 instructions is pre-set. All instructions within the current sliding window are extracted from the instruction sequence, and the function code type of each instruction is extracted as the instruction type information. The frequency of each instruction type within the sliding window is counted, and the frequency of each instruction type is divided by the total number of instructions within the sliding window to obtain the normalized frequency of that instruction type. The normalized frequencies of all instruction types within the sliding window are multiplied sequentially to obtain the product. The reciprocal of this product is multiplied by the total number of instructions within the sliding window, and the resulting value is used as the randomness measurement value. When the total number of instructions within the sliding window is less than 10, the randomness measurement value is not calculated until the number of instructions accumulates to 10.

[0067] The calculated first-order and second-order change features, along with the stochastic metric, are aligned over time and then concatenated to form a risk feature vector. Specifically, the first-order change feature corresponding to the same moment is used as the first component of the vector, the second-order change feature as the second component, and the stochastic metric as the third component. These three components together constitute a three-dimensional risk feature vector. For moments where the stochastic metric has not been calculated, the component corresponding to that stochastic metric is set to a preset default value of 0. After the risk feature vector is constructed, it is stored in a memory buffer.

[0068] In S3, the risk feature vector is compared with a preset baseline feature library, which consists of risk feature vectors from historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated, specifically including:

[0069] A baseline feature library is pre-built and stored in non-volatile memory. The construction process of the baseline feature library is as follows: During the learning phase after the initial deployment of the system, historical normal command streams are continuously collected for a preset duration, which is 168 hours; according to the methods described in S1 and S2, the collected historical normal command streams are converted into historical risk feature vectors; for each historical risk feature vector, its corresponding timestamp information is recorded; the historical risk feature vectors are divided into multiple time-series windows according to time sequence, and the length of each time-series window is consistent with the sliding window length described in S2, which is the collection duration corresponding to 10 commands; all historical risk feature vectors in each time-series window are stored as the vector set corresponding to that time-series window, forming the baseline feature library.

[0070] During risk identification, risk feature vectors and their corresponding timestamps are read from the memory buffer. Based on the timestamps, the time window to which the risk feature vector belongs is determined. The set of vectors corresponding to this time window is extracted from the baseline feature library as a comparison vector set. The comparison vector set contains risk feature vectors corresponding to all historical normal instruction sequences within this time window, and each risk feature vector is a three-dimensional vector.

[0071] Calculate the vector distance between the risk feature vector and each historical risk feature vector in the comparison vector set. The vector distance is calculated as follows: calculate the difference between the first component of the risk feature vector and the first component of the historical risk feature vector, and take the square of this difference; calculate the difference between the second component of the risk feature vector and the second component of the historical risk feature vector, and take the square of this difference; calculate the difference between the third component of the risk feature vector and the third component of the historical risk feature vector, and take the square of this difference; add these three squared values ​​together to obtain the sum of squares; take the square root of this sum of squares, and the resulting value is the vector distance.

[0072] All calculated vector distances are sorted in ascending order of value, and the smallest vector distance at the top of the sorted list is selected as the deviation metric. This deviation metric reflects the minimum degree of deviation between the current risk feature vector and the historical normal instruction sequence features.

[0073] The deviation metric is compared with a preset deviation threshold. The deviation threshold is set as follows: During the learning phase, the vector distance between each historical risk feature vector in the comparison vector set and all other historical risk feature vectors in the comparison vector set is calculated to obtain the minimum vector distance corresponding to each historical risk feature vector; all the obtained minimum vector distances are statistically analyzed, and their mean and standard deviation are calculated; the sum of the mean and three times the standard deviation is used as the deviation threshold.

[0074] When the deviation metric exceeds the deviation threshold, the current risk feature vector is determined to have deviated from the baseline feature library beyond an acceptable range. In this case, the source identifier corresponding to the risk feature vector is extracted, a risk warning signal containing that source identifier is generated, and this risk warning signal is temporarily stored in a memory buffer for subsequent steps. When the deviation metric is less than or equal to the deviation threshold, the current instruction sequence is determined to be in a normal state, and no risk warning signal is generated.

[0075] In S4, in response to a risk warning signal, a dynamic access rule is generated in the communication session corresponding to the source identifier. This dynamic access rule is configured to block subsequent command streams originating from the source identifier within a preset short time window. The dynamic access rule is then distributed to the network forwarding nodes, specifically including:

[0076] Upon receiving a risk warning signal, the signal is first parsed to extract the source identifier and the session identifier of the corresponding communication session. The source identifier includes the network layer address and application layer identity of the initiating command flow. Based on the session identifier, a pre-established session routing table is queried. This table records the node identifier and interface information of the network forwarding nodes traversed by each communication session. The network forwarding nodes through which the communication session flows are determined by matching the session identifier.

[0077] Subsequently, matching conditions are generated based on the source identifier, and a short-term time window is determined based on the risk level information. Specifically, risk level information corresponding to the source identifier is extracted from the risk warning signal. The risk level information is divided into three levels: high risk, medium risk, and low risk. Three time window lengths are preset: 1000 milliseconds for high risk, 500 milliseconds for medium risk, and 200 milliseconds for low risk. Based on the extracted risk level information, the corresponding short-term time window is selected from these three time window lengths.

[0078] The process of generating matching conditions further includes the following operations: parsing the source identifier, extracting the network layer address as the source address matching item, and extracting the application layer identity identifier as a supplementary matching item based on the authentication information already established in the communication session corresponding to the source identifier. Simultaneously, it obtains the high-risk instruction types parsed in the communication session, and matches the instruction function code range corresponding to the high-risk instruction type from a preset high-risk instruction feature library as the instruction type matching item. The preset high-risk instruction feature library is stored in non-volatile memory. This feature library contains multiple records. Each record records a high-risk instruction type and its corresponding range of one or more instruction function codes. For example, the function code range for the halt instruction is 5 to 5, and the function code range for the write register instruction is 16 to 16.

[0079] Source address matches, supplementary matches, and instruction type matches are combined in a nested manner to construct a matching condition with multiple levels of matching priority. Specifically, source address matches are first-level matches, supplementary matches are second-level matches, and instruction type matches are third-level matches. Matching is performed sequentially in the order of first-level, second-level, and third-level matches. Only when a higher-level match is successfully matched will the matching operation of the next level match continue.

[0080] After generating the matching conditions, dynamic access rules are constructed. These rules are encapsulated in triples, which contain the matching condition, the blocking action, and a short-term time window. The blocking action is a drop operation; that is, when a network forwarding node encounters a command stream that matches the conditions, it directly discards the data packets of that command stream and does not forward them. A unique rule identifier is assigned to each constructed dynamic access rule. This identifier is generated using an auto-incrementing integer and is associated with the currently processed risk warning signal, stored in a memory buffer for rule location during subsequent revocation or continuation operations.

[0081] While constructing dynamic access rules, the confidence level of these rules is calculated. This confidence level is used to determine whether additional supplementary matching terms need to be introduced. The confidence level is calculated as follows:

[0082] ;

[0083] Among them, confidence level This indicates the reliability of the current dynamic access rules. This represents the ratio of the deviation metric of the current risk feature vector from the baseline feature library to the deviation threshold. The value is 1 when the ratio is greater than 1, and 0 when it is less than or equal to 1. This represents the ratio of the frequency with which the current communication session is marked as abnormal within a preset historical period to the total number of command streams within that preset historical period, where the preset historical period is 3600 seconds. This is the first weighting coefficient, with a value of 0.6; This is the second weighting coefficient, with a value of 0.4. When the calculated confidence level... When the confidence level is greater than 0.7, the dynamic access rule is considered to have a high confidence level, and supplementary matching items are retained in the matching conditions; when the confidence level is lower than 0.7, the dynamic access rule is considered to have a high confidence level. If the confidence level is less than or equal to 0.7, the dynamic access rule is deemed to have low confidence. The supplementary matching items are removed from the matching conditions, and only the source address matching items and instruction type matching items are retained to avoid the rule becoming invalid due to the failure to obtain the application layer identity.

[0084] After constructing the dynamic access rule, it is encapsulated into an instruction format that matches the control interface of the network forwarding node. The network forwarding node is a network switch or firewall, and its control interface uses an application programming interface based on the Transmission Control Protocol (TCP). The encapsulation process includes: converting the matching conditions into an access control list syntax format that the network forwarding node can recognize; converting the blocking action into the corresponding action code of the network forwarding node; and converting the short-time window into a timestamp validity format supported by the network forwarding node. After encapsulation, an instruction carrying the dynamic access rule is sent to the network forwarding node, causing the network forwarding node to perform a blocking operation on the instruction stream matching the conditions within the short-time window.

[0085] To ensure the reliability of dynamic access rule issuance, after sending the execution command, a confirmation message is awaited from the network forwarding node. If no confirmation message is received within a preset waiting time (100 milliseconds), the command carrying the dynamic access rules is resent, with a maximum of three resentments. If no confirmation message is received after three resentments, a issuance failure event is recorded and stored in the log buffer for maintenance personnel to review.

[0086] In S5, subsequent command flows within a short time window are monitored. When the risk feature vector of a subsequent command flow falls back to the threshold range of the baseline feature library, the dynamic access rule is revoked; when the risk feature vector of a subsequent command flow continues to deviate from the baseline feature library, the effective time window of the dynamic access rule is extended, specifically including:

[0087] After dynamic access rules are issued to network forwarding nodes, a short-term time window is started, and monitoring and adaptive adjustment operations are continuously performed within this short-term time window. The monitoring process is divided into two scenarios: revoking dynamic access rules and renewing dynamic access rules.

[0088] The process of revoking dynamic access rules is as follows: Within a short time window, subsequent instruction streams originating from the source identifier are continuously captured. For each captured instruction, its numerical and type information are extracted, and the current risk feature vector corresponding to the instruction is calculated according to the method described in S2. The current risk feature vector is compared with the baseline feature library, and the current deviation metric is calculated according to the method described in S3. A preset safety fallback threshold is set as follows: During the learning phase, the vector distance between each historical risk feature vector in the comparison vector set and all other historical risk feature vectors in the comparison vector set is calculated to obtain the minimum vector distance corresponding to each historical risk feature vector. After sorting the minimum vector distance in ascending order of value, the value corresponding to the 10th percentile is selected as the safety fallback threshold. Since this safety fallback threshold is used to determine whether the risk has fallen back to the safe range, its value is lower than the deviation threshold described in S3. When the calculated current deviation metric is less than the safety fallback threshold, it is determined that the subsequent instruction stream originating from the source identifier has returned to the normal state. At this time, a revocation instruction carrying the rule identifier of the dynamic access rule is generated and sent to the network forwarding node, so that the network forwarding node deletes the dynamic access rule and restores the normal forwarding of the instruction stream originating from the source identifier.

[0089] The process of extending the effective time window of the dynamic access rule is as follows: Monitor the end time of the short time window. When the end time arrives, acquire all subsequent instruction streams originating from the source identifier captured within the entire short time window. For all instructions captured within the time window, extract the numerical and type information of each instruction in chronological order, calculate the risk feature vector corresponding to each instruction, and average each risk feature vector according to its components. Specifically, calculate the arithmetic mean of the first component, the arithmetic mean of the second component, and the arithmetic mean of the third component of all risk feature vectors. Combine the three arithmetic means to form a cumulative risk feature vector. Compare the cumulative risk feature vector with the baseline feature library and calculate the cumulative deviation metric value according to the method described in S3. Compare the cumulative deviation metric value with the preset threshold described in S3. When the cumulative deviation metric value is continuously greater than the preset threshold, it is determined that the subsequent instruction stream originating from the source identifier is in an abnormal state throughout the short time window and needs to be blocked further. At this time, a continuation rule is generated, which is configured to continue blocking the subsequent instruction stream originating from the source identifier within the continuation time window. The length of the continuation time window is consistent with the length of the short-term time window, and its value is determined based on the risk level information. The continuation rule is issued to the network forwarding nodes, and its rule identifier is associated with the rule identifier of the dynamic access rule and stored in a memory buffer so that the original rule can be located when subsequent continuation or cancellation operations are performed. For the time window after the continuation rule is issued, the above monitoring and adaptive adjustment operations are repeated until the deviation metric of the subsequent instruction flow falls below the safe fallback threshold, at which point the cancellation operation is performed.

[0090] Please see Figure 2 As shown, a network security monitoring and response system based on traffic analysis includes:

[0091] The instruction sequence construction module captures the instruction stream in the network, extracts the timing and numerical information of each instruction, and constructs an instruction sequence sorted by time as a set of instruction sequences to be analyzed.

[0092] The risk feature extraction module extracts the numerical change parameters of continuous instructions based on the instruction sequence set, and obtains the first-order and second-order change features that reflect the trend of numerical change. At the same time, it measures the randomness of the instruction type sequence to obtain the randomness measure value that reflects the uncertainty of instruction distribution. The first-order change features, second-order change features and randomness measure value are combined into a risk feature vector.

[0093] The risk identification and early warning module compares the risk feature vector with a preset baseline feature library, which consists of risk feature vectors of historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated.

[0094] The dynamic policy generation module, in response to the risk warning signal, generates dynamic access rules in the communication session corresponding to the source identifier. The dynamic access rules are configured to block subsequent command streams originating from the source identifier within a preset short time window, and then distribute the dynamic access rules to the network forwarding nodes.

[0095] The policy execution and adaptive adjustment module monitors subsequent instruction flows within a short time window. When the risk feature vector of the subsequent instruction flow falls back to the threshold range of the baseline feature library, the dynamic access rule is revoked; when the risk feature vector of the subsequent instruction flow continues to deviate from the baseline feature library, the effective time window of the dynamic access rule is extended.

[0096] The working principle of this invention is as follows: First, the instruction stream in the network is captured, and the timing and numerical information of each instruction are extracted to construct a set of instruction sequences ordered by time. Then, based on this set of instruction sequences, the numerical change parameters of consecutive instructions are extracted to obtain first-order and second-order change features, and the randomness of the instruction type sequence is measured to obtain a randomness measurement value. The above features are merged into a risk feature vector. Next, the risk feature vector is compared with a baseline feature library constructed from historical normal instruction sequences. When the deviation exceeds a preset threshold, a risk warning signal containing the source identifier is generated. In response to the risk warning signal, a dynamic access rule is generated in the communication session corresponding to the source identifier. This rule is configured to block subsequent instruction streams originating from the source identifier within a preset short time window and is sent to the network forwarding node. Finally, the subsequent instruction streams within the short time window are monitored. When the risk feature vector of the subsequent instruction stream falls back to the threshold range of the baseline feature library, the dynamic access rule is revoked. When the risk feature vector of the subsequent instruction stream continues to deviate from the baseline feature library, the effective time window of the dynamic access rule is extended, thereby achieving predictive blocking and adaptive adjustment of abnormal instruction streams.

[0097] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A network security monitoring and response method based on traffic analysis, characterized in that, Includes the following steps: S1: Capture the instruction stream in the network, extract the timing and numerical information of each instruction, and construct an instruction sequence sorted by time as a set of instruction sequences to be analyzed; S2: Based on the instruction sequence set, extract the numerical change parameters of continuous instructions to obtain the first-order and second-order change features that reflect the trend of numerical change. At the same time, measure the randomness of the instruction type sequence to obtain the randomness measure value that reflects the uncertainty of instruction distribution. Combine the first-order change features, second-order change features and randomness measure value into a risk feature vector. S3: Compare the risk feature vector with the preset baseline feature library. The baseline feature library consists of risk feature vectors of historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated. S4: In response to the risk warning signal, generate dynamic access rules in the communication session corresponding to the source identifier. The dynamic access rules are configured to block subsequent command streams originating from the source identifier within a preset short time window, and distribute the dynamic access rules to the network forwarding nodes. S5: Monitor subsequent instruction flows within a short time window. When the risk feature vector of the subsequent instruction flow falls back to the threshold range of the baseline feature library, cancel the dynamic access rule; when the risk feature vector of the subsequent instruction flow continues to deviate from the baseline feature library, extend the effective time window of the dynamic access rule.

2. The network security monitoring and response method based on traffic analysis according to claim 1, characterized in that, S2 specifically includes: Extract the numerical information of two consecutive instructions from the instruction sequence set, calculate the numerical difference between the next instruction and the previous instruction as the first-order change feature, and calculate the difference between the current first-order change feature and the previous first-order change feature as the second-order change feature. Extract the type information of each instruction in the preset sliding window from the instruction sequence set, count the frequency of occurrence of different instruction types in the sliding window, and calculate the randomness measure based on the frequency of occurrence of each instruction type and the total number of instructions in the sliding window; The first-order variation features, second-order variation features, and randomness measures are concatenated after being aligned with time to form a risk feature vector.

3. The network security monitoring and response method based on traffic analysis according to claim 2, characterized in that, The calculation of the randomness metric specifically includes: Extract all instructions within the current sliding window from the instruction sequence set, extract the type information of each instruction, count the frequency of each instruction type in the sliding window, and use the ratio of the frequency of each instruction type to the total number of instructions in the sliding window as the normalized frequency of the instruction type. The normalized frequencies of each instruction type within the sliding window are multiplied, and the reciprocal of the product is multiplied by the total number of instructions within the sliding window to obtain a randomness measure.

4. The network security monitoring and response method based on traffic analysis according to claim 1, characterized in that, S3 specifically includes: Obtain the timestamp information corresponding to the risk feature vectors, and extract historical risk feature vectors within the same time window from the baseline feature library based on the timestamp information to form a comparison vector set; Calculate the vector distance between the risk feature vector and each historical risk feature vector in the comparison vector set, sort the vector distances, and select the smallest distance value in the sort as the deviation metric. The deviation metric is compared with a preset deviation threshold. When the deviation metric is greater than the deviation threshold, it is determined that the degree of deviation of the risk feature vector from the baseline feature library exceeds the preset threshold, and a risk warning signal containing the source identifier is generated.

5. The network security monitoring and response method based on traffic analysis according to claim 1, characterized in that, S4 specifically includes: Analyze the risk warning signal, extract the source identifier and the session identifier of the communication session corresponding to the source identifier, and determine the network forwarding nodes through which the communication session flows; The matching conditions are generated based on the source identifier, and the effective time period is generated based on the preset short time window. The matching conditions are associated with the blocking action and embedded into the effective time period to form dynamic access rules. The dynamic access rules are encapsulated into an instruction format that matches the control interface of the network forwarding node. Instructions carrying the dynamic access rules are sent to the network forwarding node, so that the network forwarding node blocks the instruction stream that matches the conditions during the effective period.

6. The network security monitoring and response method based on traffic analysis according to claim 5, characterized in that, The dynamic access rules specifically include: Obtain the source identifier and extract the risk level information corresponding to the source identifier from the risk warning signal. Select one of the preset time window lengths as the short time window based on the risk level information. Based on the source identifier and the high-risk instruction types parsed in the communication session, generate matching conditions that include source address matching items and instruction type matching items; The matching conditions, blocking actions, and short-term time windows are encapsulated into dynamic access rules in the form of triples, and a rule identifier is assigned to the dynamic access rules. The rule identifier is then associated with and stored with the risk warning signal.

7. A network security monitoring and response method based on traffic analysis according to claim 6, characterized in that, The generation of matching conditions, which includes source address matching items and instruction type matching items, specifically includes: Parse the source identifier, extract the network layer address as the source address matching item, and extract the application layer identity identifier as a supplementary matching item based on the authentication information already established in the communication session corresponding to the source identifier. Obtain the high-risk instruction types that have been parsed in the communication session, and match the instruction function code range corresponding to the high-risk instruction type from the preset high-risk instruction feature library as the instruction type matching item; The source address match, supplementary match, and instruction type match are combined in a hierarchical nesting manner to construct a matching condition with multiple levels of matching priority.

8. The network security monitoring and response method based on traffic analysis according to claim 1, characterized in that, The rules for revoking dynamic access specifically include: Within a short time window, continuously capture subsequent instruction streams originating from the source identifier, extract the numerical and type information of each instruction in the subsequent instruction stream, and calculate the current risk feature vector of the subsequent instruction stream. The current risk feature vector is compared with the baseline feature library to obtain the current deviation measure. The current deviation measure is then compared with the preset safety fallback threshold. If the safety fallback threshold is lower than the preset threshold, then the current deviation measure is compared with the preset safety fallback threshold. When the current deviation metric is less than the safety fallback threshold, a revocation command carrying the rule identifier of the dynamic access rule is generated and sent to the network forwarding node, causing the network forwarding node to delete the dynamic access rule.

9. A network security monitoring and response method based on traffic analysis according to claim 1, characterized in that, The process of continuing the dynamic access rules specifically includes: Monitor the end time of the short time window, and when the end time arrives, obtain the subsequent instruction stream originating from the source identifier within the short time window, and calculate the cumulative risk feature vector of the subsequent instruction stream within the short time window; The cumulative risk feature vector is compared with the baseline feature library to obtain the cumulative deviation measure, and the cumulative deviation measure is compared with a preset threshold. When the cumulative deviation metric value continues to exceed the preset threshold, a continuation rule is generated. The continuation rule is configured to continue blocking subsequent instruction streams originating from the source identifier within the continuation time window, and the continuation rule is sent to the network forwarding node. At the same time, the continuation rule is associated with and stored with the dynamic access rule.

10. A network security monitoring and response system based on traffic analysis, characterized in that, A network security monitoring and response method based on traffic analysis as described in any one of claims 1-9, comprising: The instruction sequence construction module captures the instruction stream in the network, extracts the timing and numerical information of each instruction, and constructs an instruction sequence sorted by time as a set of instruction sequences to be analyzed. The risk feature extraction module extracts the numerical change parameters of continuous instructions based on the instruction sequence set, and obtains the first-order and second-order change features that reflect the trend of numerical change. At the same time, it measures the randomness of the instruction type sequence to obtain the randomness measure value that reflects the uncertainty of instruction distribution. The first-order change features, second-order change features and randomness measure value are combined into a risk feature vector. The risk identification and early warning module compares the risk feature vector with a preset baseline feature library, which consists of risk feature vectors of historical normal instruction sequences. When the risk feature vector deviates from the baseline feature library by more than a preset threshold, a risk warning signal containing the source identifier is generated. The dynamic policy generation module, in response to the risk warning signal, generates dynamic access rules in the communication session corresponding to the source identifier. The dynamic access rules are configured to block subsequent command streams originating from the source identifier within a preset short time window, and then distribute the dynamic access rules to the network forwarding nodes. The policy execution and adaptive adjustment module monitors subsequent instruction flows within a short time window. When the risk feature vector of the subsequent instruction flow falls back to the threshold range of the baseline feature library, the dynamic access rule is revoked; when the risk feature vector of the subsequent instruction flow continues to deviate from the baseline feature library, the effective time window of the dynamic access rule is extended.

Images