Computer network communication security monitoring method

Abstract

The application discloses a computer network communication security monitoring method and relates to the technical field of computer network and information security, which comprises the following steps: collecting continuous change records in the network communication process, constructing an intensity change sequence according to the time sequence, identifying a time section with a continuous decline in the communication flow in the intensity change sequence, and constructing a decline reference according to the change amplitude in the time section; comparing the change amplitudes of each time position in the corresponding time section in the intensity change sequence around the decline reference, determining abnormal rising positions deviating from the decline reference, and forming an isolated impact mark set. The application separates the abnormal rising positions and constructs independent impact sequences and continuous change sequences, so that the abnormal changes do not participate in the overall trend determination, and the sudden change interference is reduced. Meanwhile, through rhythm control and synchronous adjustment, the continuity and consistency of the communication changes are maintained, the identification stability is improved, and the security response fluctuation is avoided.

Description

Technical Field

[0001] This invention relates to the field of computer network and information security technology, specifically to a method for monitoring and protecting computer network communications. Background Technology

[0002] Computer network communication security monitoring refers to a set of technical means that continuously collects, correlates, analyzes, and dynamically monitors network communication status during the operation of a computer network, focusing on the data transmission behavior, access interaction process, and communication path changes between nodes. Its core lies in the unified organization of information such as the source, destination, transmission frequency, protocol characteristics, and time sequence of data flows to construct a monitoring system that can reflect the laws of communication behavior. On this basis, it identifies abnormal communication patterns, such as abnormal traffic surges, unauthorized access, unauthorized connections, or abnormal data transmission. At the same time, it combines preset security policies to locate, mark, and respond to abnormal behaviors, thereby achieving visualized perception, risk identification, and security protection of the entire network communication process, ensuring the stability of network system operation and the security of data transmission.

[0003] The existing technology has the following shortcomings: In existing technologies, as network communication intensity gradually decreases, security monitoring typically relies on data trends over a continuous timeframe for assessment. When overall communication volume continuously weakens, the system tends to lower the risk assessment level. However, in actual operation, sudden high-intensity data spikes may occur at certain time points. These spikes lack a continuous transition with preceding and following communication states, easily forming isolated burst peaks in the time series. In such cases, existing security strategies may misidentify these sudden changes as abnormal attack behavior, frequently triggering alarms or restrictive measures. When such burst peaks repeatedly occur at different time points, security strategies are easily triggered continuously, leading to a chaotic system response and affecting the stable identification and processing of normal communication behavior.

[0004] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a computer network communication security monitoring method to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a computer network communication security monitoring method, comprising the following steps: Collect continuous change records during network communication, construct an intensity change sequence in chronological order, identify time periods in the intensity change sequence where communication volume continuously decreases, and construct a decrease reference based on the change magnitude within the time period; Around the descending reference, the change amplitude of each time position in the corresponding time segment of the intensity change sequence is compared to determine the abnormal rise position that deviates from the descending reference and form a set of isolated impact markers; By combining isolated impact marker sets, the connection relationship between the changes before and after each abnormal rise position in the intensity change sequence is analyzed, the change segments formed by continuous changes and the inserted change segments are distinguished, and the impact insertion order is constructed. Based on the impact insertion order, the abnormal rise positions in the intensity change sequence are separated. The abnormal rise positions are removed from the intensity change sequence and the continuous change relationship is restored to obtain independent impact sequences and continuous change sequences. The subsequent intensity change sequence is processed based on independent impact sequences and continuously changing sequences. The rhythm of the independent impact sequence is controlled, and the overall change is adjusted synchronously based on the continuously changing sequence to reduce the impact of abnormally high positions on the safety response.

[0007] Preferably, the steps for constructing the descent reference are as follows: The continuous change records during network communication are collected point-by-point and arranged according to a uniform time interval to construct an intensity change sequence that corresponds one-to-one with the time position; The communication intensity values ​​at each time point are compared point by point along the time sequence of intensity change to determine the time points where the communication volume is continuously decreasing and form the time segment where the communication volume is continuously decreasing. At the same time, the start and end time points of the time segment are recorded. Within the time period of continuous decline in communication volume, the communication intensity difference between adjacent time positions in the intensity change sequence is extracted and arranged in chronological order to construct a change amplitude sequence corresponding to the time position; The time periods of continuous decline in communication volume, the communication intensity values ​​at each time point within the time periods, and the sequence of changes are correlated and organized to form a decline reference.

[0008] Preferably, the steps for forming an isolated impact marker set are as follows: The time interval covered by the descent reference is expanded, and a continuous subsequence of the corresponding time interval is extracted from the intensity change sequence. The reference change amplitude and the actual change amplitude at each time position in the continuous subsequence are aligned and arranged to form an aligned change record sequence. By comparing the reference change amplitude with the actual change amplitude at each time position along the time sequence of the alignment change record, the time position where the reference change amplitude is in the downward direction and the actual change amplitude is in the upward direction is determined, forming a set of candidate positions for abnormal rise. By combining the reference change amplitude and the actual change amplitude of adjacent time positions in the alignment change record sequence, the set of candidate abnormal rise positions is filtered point by point, and the time positions that show a decreasing relationship between the preceding and following time positions and an increasing relationship between the current time position are retained to determine the abnormal rise positions. The locations of abnormally high elevations are arranged in chronological order, and associated with time and location markers, reference change ranges, and actual change ranges to form a set of isolated impact markers.

[0009] Preferably, the steps for constructing the impact insertion order are as follows: The abnormal rise locations in the isolated impact marker set are unfolded in chronological order, and the corresponding time positions are located in the intensity change sequence. The communication intensity values ​​and change amplitudes of continuous time positions are read forward and backward to form a local continuous change record. By combining local continuous change records, the direction of the change amplitude before and after the abnormal rise position is sorted out, and the preceding continuous change segment and the following continuous change segment are divided. Based on the directional relationship between the change amplitude of the abnormal rise position and the preceding and following continuous change segments, the change segments formed by continuous change and the inserted change segments are determined. The temporal position of each change segment in the intensity change sequence is organized around the inserted change segments and the change segments formed by continuous changes, and the temporal connection relationship between adjacent change segments is recorded; Based on the temporal order of the inserted change segments, each change segment is numbered, and the impact insertion order is constructed by combining the temporal position with the relationship between the change segments formed by adjacent continuous changes.

[0010] Preferably, when dividing the preceding continuous change segment and the following continuous change segment, the change amplitude of adjacent time positions before and after the abnormal rise position is compared point by point to determine the consistency of the change direction of the preceding continuous change segment and the following continuous change segment. Based on the change amplitude of the abnormal rise position and the directional relationship of the preceding and following continuous change segments, the identification range of the inserted change segment is limited.

[0011] Preferably, the steps for obtaining independent impact sequences and continuously changing sequences are as follows: Based on the order of impact insertion, the inserted change segments in the intensity change sequence are located segment by segment, and the time position corresponding to each change segment is marked to form the inserted change segment segment and the unmarked continuous change segment. Around the inserted change segments, the communication intensity value and change amplitude of each segment at the time position are extracted and arranged according to the order of impact insertion to construct an independent impact sequence; Based on the extraction results of the inserted change segments, the unidentified time positions in the intensity change sequence are rearranged to form a continuous change sequence; Based on independent impact sequences and continuous change sequences, the time positions of each time location in the original intensity change sequence are recorded and the time sequence is compared and organized. Independent impact sequences and continuously changing sequences are expressed separately according to time sequence for the separation of abnormal rise locations and continuously changing processes.

[0012] Preferably, the inserted change segments are arranged in chronological order according to the order of impact insertion, and the time position corresponding to each change segment is associated with the communication intensity value and the change amplitude. At the same time, the time position in the continuous change sequence is synchronously recorded, and the time alignment expression of independent impact sequences and continuous change sequences is achieved through a unified time position identifier.

[0013] Preferably, the following steps are taken to process the subsequent intensity change sequence based on the independent impact sequence and the continuously changing sequence, to control the rhythm of the independent impact sequence, and to make synchronous adjustments based on the continuously changing sequence: The subsequent intensity change sequence is read time-by-time and aligned with the continuous change sequence in terms of time position. At the same time, the time range is mapped with the change segments in the independent impact sequence to form the subsequent change record structure. By arranging the amplitude of changes within the corresponding time range around the changing segments in the independent impact sequence and covering the corresponding time positions in the subsequent intensity change sequence, rhythm control is achieved. By combining the change amplitude of each time position in the continuous change sequence, the direction of the time positions in the subsequent intensity change sequence that are not within the time range of the independent impact sequence is adjusted, and the connection adjustment is made for the time positions that are within the time range of the independent impact sequence; Based on the results of rhythm control and synchronization adjustment, the time positions in the subsequent intensity change sequence are arranged to form a change structure caused by the combined effect of continuous change sequence and independent impact sequence.

[0014] The technical effects and advantages provided by the present invention in the above technical solution are as follows: This invention continuously unfolds and structurally reorganizes the communication intensity change process, separating isolated abnormal rise locations from the overall change trajectory and expressing them separately as independent impact sequences. This prevents abnormal changes from directly participating in the determination of the overall change trend, thereby effectively avoiding interference from local sudden changes in the judgment of the overall communication status while maintaining the continuity of time. This improves the accuracy of identifying communication process change characteristics, enabling the security response process to unfold stably around the continuous change trajectory and reducing misjudgments caused by isolated sudden changes.

[0015] This invention, through the coordinated processing of independent impact sequences and continuously changing sequences, ensures that the overall communication change process maintains a continuous rhythm while introducing independent rhythm constraints at abnormally high positions. This results in a change structure dominated by continuously changing sequences during subsequent intensity changes, and local control over abnormal changes. Consequently, the communication changes remain coherent in the time dimension and consistent in the amplitude of changes, improving the stability of communication behavior recognition and ensuring that the safety response is executed consistently within a continuous time range, avoiding fluctuations in the response process caused by repeated abnormal changes. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a flowchart of the computer network communication security monitoring method of the present invention. Detailed Implementation

[0018] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0019] This invention provides, for example Figure 1 The computer network communication security monitoring method shown includes the following steps: Collect continuous change records during network communication, construct an intensity change sequence in chronological order, identify time periods in the intensity change sequence where communication volume continuously decreases, and construct a decrease reference based on the change magnitude within the time period; The continuous change records generated during network communication are expanded and refined layer by layer, so that the change process of communication intensity in the time dimension can be expressed in a form with a continuous correspondence. In this process, time segments with continuously decreasing communication volume are extracted, and reusable decrease references are established around the change amplitude within the time segments. The specific implementation steps are as follows: The system collects continuous change records generated during network communication point by point in time, and arranges the communication intensity data corresponding to each point in time according to a uniform time interval, so that all points in time are unfolded sequentially on the same time axis. During the arrangement process, the communication intensity value corresponding to each point in time is bound to its time position one-to-one, so that any time position can be uniquely mapped to the corresponding communication intensity value. On this basis, all points in time are connected continuously in chronological order to form a complete intensity change sequence. In the process of forming the intensity change sequence, the time interval is uniformly divided to keep the time span between any adjacent points in time consistent, thereby ensuring the continuity of the intensity change sequence in the time dimension. At the same time, all original time positions and corresponding communication intensity values ​​are retained in the sequence, without deleting or rearranging intermediate data, so that subsequent processing can be directly unfolded based on continuous time order.

[0020] Based on the established intensity change sequence, the direction of communication intensity change between each time position and its previous time position is analyzed point by point along the time sequence. The communication intensity value of the current time position is compared with the communication intensity value of the previous time position. When the communication intensity value of the current time position is lower than that of the previous time position, the time position is marked as a decreasing position, and the same point-by-point comparison is continued for subsequent time positions. When multiple consecutive time positions satisfy the condition that the communication intensity value of the current time position is lower than that of the previous time position, the continuous time range is divided into time segments with continuously decreasing communication volume. During the division process, the start and end time positions of each time segment are recorded, and it is ensured that all time positions within the time segment satisfy the continuous decreasing change relationship, thus forming a set of multiple time segments with clear boundaries. Each time segment corresponds to a continuous subsequence in the intensity change sequence.

[0021] Within the identified time intervals of continuously decreasing communication volume, the intensity change sequence corresponding to these time intervals is extracted time-by-time. Specifically, the difference in communication intensity between each time position and its preceding time position is calculated one by one, and the change amplitudes at each time position are arranged continuously in chronological order, maintaining a consistent order between the change amplitudes and time positions. During the arrangement process, each change amplitude is bound to its corresponding time position, ensuring that any change amplitude corresponds to its specific time position. After the change amplitude extraction is completed, all change amplitudes within the same time interval are continuously organized in chronological order to form a change amplitude sequence. This change amplitude sequence fully reflects the entire process of the gradual change in communication intensity from the starting position to the ending position within the time interval, and the continuous arrangement reflects the connection between each change amplitude, thus expressing the rhythm of change within the time interval in the form of continuous change amplitudes.

[0022] Each time segment of continuously decreasing communication volume is integrated with its corresponding change amplitude sequence. All time positions, corresponding communication intensity values, and change amplitude sequences within a time segment are correlated holistically, establishing a fixed correspondence among them. Based on this, a decline reference is constructed, using the time segment as the scope and the change amplitude sequence as the core content. During construction, the start and end times of the time segment, as well as the chronologically ordered change amplitude sequence within that time segment, are recorded uniformly, ensuring the decline reference fully expresses the continuous decline process of communication intensity within that time segment. Simultaneously, the above processing is applied to different time segments separately, forming multiple decline references while maintaining temporal independence between them. This allows subsequent processing to call upon the corresponding decline reference for comparison across different time segments, providing a clear and continuous reference basis for identifying abnormally high positions in the intensity change sequence.

[0023] Around the descending reference, the change amplitude of each time position in the corresponding time segment of the intensity change sequence is compared to determine the abnormal rise position that deviates from the descending reference and form a set of isolated impact markers; The relationship between the descent reference and the intensity change sequence is refined and expanded to allow for point-by-point identification of local deviations in communication intensity during the descent process. Furthermore, while maintaining temporal continuity, abnormally high points deviating from the descent reference are precisely extracted and centrally organized to form a set of isolated impact markers with complete temporal correlation. The specific implementation steps are as follows: The time interval covered by the descent reference is expanded time-by-time, and a continuous subsequence completely consistent with the start and end time positions of the time interval is extracted from the intensity change sequence. During the extraction process, each time position in the continuous subsequence is matched one-to-one with the corresponding time position in the descent reference, ensuring a completely consistent correspondence in the time dimension. Based on this, the change amplitude recorded in the descent reference and the actual change amplitude at the corresponding time position in the intensity change sequence are extracted point-by-point. The reference change amplitude and the actual change amplitude at each time position are arranged side by side in chronological order, so that each time position corresponds to a set of combined data consisting of the reference change amplitude and the actual change amplitude. The chronological order is maintained during the arrangement process, and all combined data are continuously distributed in chronological order, thus forming a complete aligned change record sequence. Each time position in this aligned change record sequence contains a clear time position identifier, reference change amplitude, and actual change amplitude, providing a continuous and unified data foundation for subsequent deviation identification.

[0024] Based on the alignment change record sequence, the relationship between the actual change amplitude and the reference change amplitude at each time position is compared point by point along the time sequence. During the comparison process, for each time position, the reference change amplitude corresponding to that time position is read first, and then the actual change amplitude corresponding to the same time position is read. The directional relationship between the two is determined. When the reference change amplitude shows a decreasing direction and the actual change amplitude shows an increasing direction, the time position is marked as an abnormal rise candidate position, and the combined data corresponding to that time position is recorded in the abnormal rise candidate position set. After completing the comparison of the current time position, the process continues to advance to the next time position according to the time sequence, and the above reading and determination process is repeated so that all time positions in the entire time segment are compared point by point, thereby obtaining a set containing multiple abnormal rise candidate positions. In this set, each abnormal rise candidate position retains its time position identifier, reference change amplitude, and actual change amplitude, and maintains consistency with the time sequence in the alignment change record sequence.

[0025] After the set of candidate abnormal rise positions is formed, each time position in the set is traversed again in chronological order. Combined with the combined data of adjacent time positions in the alignment change record sequence, the change connection relationship of each candidate abnormal rise position is refined and organized. Specifically, for a candidate abnormal rise position, the combined data of the reference change amplitude and actual change amplitude of its previous time position is read, and then the combined data of the reference change amplitude and actual change amplitude of its subsequent time position is read. By continuously comparing these three sets of combined data, the change pattern of the time position in the time series is determined. When the actual change amplitude of the time position changes from decreasing to increasing relative to the previous time position, and then resumes the decreasing direction in the subsequent time position, the time position is identified as an abnormal rise position and retained. When the time position forms a continuous increasing relationship with its adjacent time positions, the time position is removed from the set of candidate abnormal rise positions. This ensures that the finally retained time positions are all single-point increases that appear during the decreasing process, thus guaranteeing that the identification result of abnormal rise positions is consistent with the temporal continuity.

[0026] After screening the abnormal rise locations, all abnormal rise locations were organized in chronological order, and the time position corresponding to each abnormal rise location was clearly marked in the intensity change sequence. During the organization process, the time position mark, reference change amplitude, and actual change amplitude corresponding to each abnormal rise location were uniformly associated and arranged in chronological order, so that all abnormal rise locations formed a continuous distribution relationship on the time axis. On this basis, all abnormal rise locations were aggregated to form an isolated impact marker set. This isolated impact marker set completely retains the time position of each abnormal rise location in the intensity change sequence and its corresponding change information, and maintains the correspondence with the descent reference. This allows subsequent processing to be directly carried out around the isolated impact marker set, and further analysis and processing of abnormal rise locations in the intensity change sequence can be performed.

[0027] By combining isolated impact marker sets, the connection relationship between the changes before and after each abnormal rise position in the intensity change sequence is analyzed, the change segments formed by continuous changes and the inserted change segments are distinguished, and the impact insertion order is constructed. By combining the time-series mapping relationship between isolated impact marker sets and intensity change sequences, the connection between the preceding and following changes of each anomaly elevation position in the time series is fully restored. Furthermore, different change patterns are finely divided within the continuous time structure, thereby distinguishing between change segments formed by continuous changes and intervening change segments on a unified time axis, and further forming an impact insertion sequence with a clear chronological relationship. The specific implementation steps are as follows: Each abnormal rise position recorded in the isolated impact marker set is unfolded sequentially according to time, and the specific time position corresponding to each abnormal rise position is located in the intensity change sequence. After the location is completed, the communication intensity value and change amplitude corresponding to the previous time position are read forward from the center of that time position, and the communication intensity value and change amplitude of multiple consecutive time positions are read forward until the time position where the change direction changes. At the same time, the communication intensity value and change amplitude corresponding to the next time position are read backward from the center of that time position, and the communication intensity value and change amplitude of multiple consecutive time positions are read backward until the time position where the change direction changes. Through the above continuous reading of forward and backward extension, each abnormal rise position corresponds to a local change range containing multiple time positions. Within the local change range, the change amplitude of each time position is arranged in chronological order, and the position of the abnormal rise position in this arrangement is clearly marked, thereby forming a local continuous change record around a single abnormal rise position.

[0028] Based on the existing local continuous change records, the connection between changes before and after each abnormal rise position is systematically organized. Specifically, the change amplitudes at each time position in the local continuous change records are read sequentially according to time order. First, the change amplitudes of continuous time positions before the abnormal rise position are directionally organized, and all continuous time positions showing changes in the same direction are grouped into preceding continuous change segments. Then, the change amplitudes of continuous time positions after the abnormal rise position are directionally organized in the same way, and all continuous time positions showing changes in the same direction are grouped into subsequent continuous change segments. After completing the organization of preceding and subsequent continuous change segments... The variation amplitude of the abnormal rise position itself is combined with the preceding and following continuous variation segments for analysis. When the variation amplitude direction of the abnormal rise position is inconsistent with the variation direction of the preceding and following continuous variation segments, the local variation range corresponding to the abnormal rise position is marked as an inserted variation segment. When the variation amplitude direction of the abnormal rise position is consistent with the preceding or following continuous variation segments, the local variation range where the abnormal rise position is located is marked as a variation segment formed by continuous variation. Through the above segment-by-segment analysis, each abnormal rise position obtains a clear variation segment type.

[0029] After classifying all abnormally elevated position change segments, all change segments marked as insertions are organized in chronological order. During this process, the start and end times of each insertion segment in the intensity change sequence are read sequentially, and all time positions within that segment are arranged chronologically. The temporal connection between the segment and the preceding segment formed by continuous changes is also recorded, ensuring that each insertion segment clearly indicates its insertion position within the overall intensity change sequence. Simultaneously, the change segments formed by continuous changes are organized in the same chronological order, creating an alternating distribution between continuous and insertion segments on the same time axis while maintaining temporal continuity among all segments. This results in the entire intensity change sequence being divided into multiple sequences of change segments arranged chronologically.

[0030] After organizing the temporal sequence of the change segments, all inserted change segments are sequentially numbered. Each inserted change segment is assigned a unique number according to its chronological order within the intensity change sequence. The start and end times of each number, as well as its relationship to adjacent consecutive change segments, are recorded. After numbering, all inserted change segments are arranged according to their numbers to form an impact insertion order. This impact insertion order, based on temporal sequence, expresses each abnormally increasing position of the inserted change segment in an orderly manner, maintaining a one-to-one correspondence with the temporal position in the intensity change sequence. This allows subsequent processing to address abnormally increasing positions one by one according to the impact insertion order, thereby achieving refined control over the communication intensity change process.

[0031] Based on the impact insertion order, the abnormal rise positions in the intensity change sequence are separated. The abnormal rise positions are removed from the intensity change sequence and the continuous change relationship is restored to obtain independent impact sequences and continuous change sequences. Based on the temporal correspondence between the impact insertion order and the intensity change sequence, a layer-by-layer refinement process is performed to fully unfold the distribution of each abnormal rise location in the original change process. While maintaining the temporal order, the abnormal rise locations are systematically separated from the original change process, and the separated time series are continuously recombined to form independent impact sequences and continuous change sequences. The specific implementation steps are as follows: Based on the temporal position order of each inserted change segment recorded in the impact insertion sequence, the intensity change sequence is segment-by-segment located. During the location process, the start and end time positions of each inserted change segment are read sequentially according to the arrangement order in the impact insertion sequence, and all time positions between the start and end time positions are marked one by one in the intensity change sequence. During the marking process, each time position is bound to its corresponding communication intensity value and change amplitude, so that each inserted change segment forms a continuous marked interval in the intensity change sequence. After marking all inserted change segments, the intensity change sequence is divided into multiple time segments arranged in chronological order, including the marked inserted change segment segments and the unmarked continuous change segments, and the arrangement order of each time segment on the time axis is kept consistent with the original intensity change sequence.

[0032] Based on the defined intensity change sequence segment structure, all segments identified as inserted change fragments are extracted one by one. During the extraction process, each inserted change fragment segment is read sequentially according to the chronological order of the impact insertion order. The communication intensity values ​​and change amplitudes corresponding to all time positions within the segment are completely extracted in chronological order, ensuring that the extraction results are consistent with the original chronological order. After the extraction of a single change fragment segment is completed, all time positions corresponding to that segment, along with their communication intensity values ​​and change amplitudes, are removed from the intensity change sequence. Simultaneously, the same extraction and removal process is continued for the next change fragment segment until all inserted change fragment segments have been extracted and removed. After all extractions are completed, the change fragment segments are arranged consecutively according to the chronological order of the impact insertion order, so that all extracted change fragments form an independently arranged time sequence, thereby constructing an independent impact sequence. In this independent impact sequence, each time position retains the communication intensity value and change amplitude corresponding to its original time position, and maintains a unified arrangement relationship according to the impact insertion order.

[0033] For the remaining unidentified time positions in the intensity change sequence, continuous reconstruction processing is performed. During the reconstruction process, all remaining time positions are rearranged according to time order, and the time positions that were originally separated by the inserted change segments are reconnected sequentially, so that the end time position of the previous unidentified time segment is directly connected to the start time position of the next unidentified time segment, while maintaining the continuity of time order. During the connection process, the communication intensity value and change amplitude corresponding to each time position are preserved as is without adjustment, so that the reconstructed time sequence fully reflects the continuous change trajectory after removing the abnormally high positions, thus forming a continuous change sequence. This continuous change sequence only contains the unextracted time positions and maintains the chronological relationship of the original change process.

[0034] By combining the temporal distribution of independent impact sequences and continuously varying sequences, a unified recording process is implemented to establish the temporal correspondence between the two types of sequences. During the recording process, each time position in the independent impact sequence is recorded one-to-one with its corresponding time position in the original intensity variation sequence, and similarly, each time position in the continuously varying sequence is recorded one-to-one with its corresponding time position in the original intensity variation sequence. This ensures that all time positions in both types of sequences have a clear original time position identifier. Based on this, the time positions in the independent impact sequence and the continuously varying sequence are compared and organized according to their original chronological order, so that any original time position can be mapped to a specific position in either the independent impact sequence or the continuously varying sequence. This guarantees that the temporal structure of the two types of sequences remains consistent during subsequent processing.

[0035] Based on the construction results of independent impact sequences and continuously changing sequences, the two types of sequences are processed separately. The independent impact sequence is used to record the complete change process corresponding to all inserted change segments, while the continuously changing sequence is used to record the continuous change trajectory after removing the inserted change segments. By expressing the two types of sequences independently, the subsequent processing can perform differentiated processing on the independent impact sequence and the continuously changing sequence respectively. While maintaining the consistency of the overall time structure, it is possible to separate the control of the abnormal rise position and the continuous change process, thereby reducing the interference of the abnormal rise position on the overall communication change process and maintaining the continuity of the communication change process.

[0036] The subsequent intensity change sequence is processed based on independent impact sequences and continuously changing sequences. The rhythm of independent impact sequences is controlled, and the overall change is adjusted synchronously based on the continuously changing sequence to reduce the impact of abnormally high positions on the safety response. The time-by-time position is analyzed based on the temporal correspondence between independent impact sequences and continuously changing sequences. Subsequent intensity change sequences are then incorporated into a unified time structure for coordinated processing. This ensures that the abnormal rise position is rhythmically constrained during subsequent changes, while maintaining consistency in the overall change trajectory with the continuously changing sequence. Thus, the influence range of the abnormal rise position is controlled through the combined effect of temporal continuity and consistency of change. The specific implementation steps are as follows: Based on the temporal correspondence between independent impact sequences and continuously changing sequences, subsequent intensity change sequences are read time-by-time. Each time position in the subsequent intensity change sequence is arranged sequentially according to time. The communication intensity value and change amplitude corresponding to that time position are associated one by one with the change amplitude of the corresponding time position in the continuously changing sequence, so that each subsequent time position forms a correspondence with the continuously changing sequence. In the process of forming the correspondence, the time positions in the subsequent intensity change sequence are aligned with the time positions in the continuously changing sequence to maintain consistency in temporal order. At the same time, the time range of each change segment recorded in the independent impact sequence is mapped to the time position in the subsequent intensity change sequence, so that each time position in the subsequent intensity change sequence can be clearly identified as falling within the time range corresponding to the independent impact sequence. This forms a subsequent change record structure that includes the continuous change reference relationship and the independent impact time mapping relationship.

[0037] Based on the established subsequent change record structure, the change rhythm in the independent impact sequence is processed segment by segment. The start and end times of each change segment in the independent impact sequence are read, and the change amplitudes corresponding to each time position within that time range are arranged continuously in chronological order, so that each change segment forms a complete rhythm sequence. On this basis, each rhythm sequence in the independent impact sequence is matched one by one with the time positions of the corresponding time range in the subsequent intensity change sequence. During the matching process, the rhythm sequence in the independent impact sequence is covered time position by time position to the change positions within the corresponding time range of the subsequent intensity change sequence, so that the time positions in the subsequent intensity change sequence within the time range of the independent impact are arranged according to the change order in the independent impact sequence. Thus, the change process of these time positions is constrained by the rhythm sequence in the independent impact sequence, and the consistency between the chronological order and the change order is maintained.

[0038] By combining the rhythm coverage results of independent impact sequences, the change process in the continuous change sequence is processed time-by-time. The change amplitude of each time position in the continuous change sequence is extracted in chronological order, and this change amplitude is compared one by one with the change amplitude of the corresponding time position in the subsequent intensity change sequence. During the comparison process, the time positions in the subsequent intensity change sequence that are not within the independent impact time range are adjusted so that their change amplitudes are consistent with the change amplitudes of the corresponding time positions in the continuous change sequence. At the same time, for the time positions that are within the independent impact time range, while maintaining the rhythm order of the independent impact sequence, the change connection relationship between the adjacent time positions is kept consistent with the change connection relationship in the continuous change sequence. Thus, the entire subsequent intensity change sequence is consistent with the continuous change sequence in the overall change direction, and reflects the rhythm characteristics of the independent impact sequence within a local time range.

[0039] For subsequent intensity change sequences that have completed synchronization adjustments, all time positions in the subsequent intensity change sequence are uniformly organized and rearranged according to time order, while maintaining the correspondence between the communication intensity value and change amplitude corresponding to each time position and its time position. During the organization process, the time positions controlled by the rhythm of the independent impact sequence and the time positions adjusted according to the continuous change sequence are uniformly expressed, so that the entire subsequent intensity change sequence forms a continuous arrangement relationship on the time axis. In terms of change structure, it forms a combination structure dominated by the continuous change sequence and supplemented by the rhythm constraint of the independent impact sequence. In this way, the influence range of abnormally rising positions is limited in the subsequent communication process, avoiding the expansion of the abnormally rising positions within the continuous time range, and maintaining the stable connection relationship of the overall communication change process.

[0040] This invention continuously unfolds and structurally reorganizes the communication intensity change process, separating isolated abnormal rise locations from the overall change trajectory and expressing them separately as independent impact sequences. This prevents abnormal changes from directly participating in the determination of the overall change trend, thereby effectively avoiding interference from local sudden changes in the judgment of the overall communication status while maintaining the continuity of time. This improves the accuracy of identifying communication process change characteristics, enabling the security response process to unfold stably around the continuous change trajectory and reducing misjudgments caused by isolated sudden changes.

[0041] This invention, through the coordinated processing of independent impact sequences and continuously changing sequences, ensures that the overall communication change process maintains a continuous rhythm while introducing independent rhythm constraints at abnormally high positions. This results in a change structure dominated by continuously changing sequences during subsequent intensity changes, and local control over abnormal changes. Consequently, the communication changes remain coherent in the time dimension and consistent in the amplitude of changes, improving the stability of communication behavior recognition and ensuring that the safety response is executed consistently within a continuous time range, avoiding fluctuations in the response process caused by repeated abnormal changes.

[0042] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A computer network communication security monitoring method, characterized in that, Includes the following steps: Collect continuous change records during network communication, construct an intensity change sequence in chronological order, identify time periods in the intensity change sequence where communication volume continuously decreases, and construct a decrease reference based on the change magnitude within the time period; The steps for constructing a descent reference are as follows: The continuous change records during network communication are collected point-by-point and arranged according to a uniform time interval to construct an intensity change sequence that corresponds one-to-one with the time position; The communication intensity values ​​at each time point are compared point by point along the time sequence of intensity change to determine the time points where the communication volume is continuously decreasing and form the time segment where the communication volume is continuously decreasing. At the same time, the start and end time points of the time segment are recorded. Within the time period of continuous decline in communication volume, the communication intensity difference between adjacent time positions in the intensity change sequence is extracted and arranged in chronological order to construct a change amplitude sequence corresponding to the time position; The time periods of continuous decline in communication volume, the communication intensity values ​​at each time position within the time period, and the sequence of changes are correlated and organized to form a decline reference; Around the descending reference, the change amplitude of each time position in the corresponding time segment of the intensity change sequence is compared to determine the abnormal rise position that deviates from the descending reference and form a set of isolated impact markers; The steps for forming an isolated impact marker set are as follows: The time interval covered by the descent reference is expanded, and a continuous subsequence of the corresponding time interval is extracted from the intensity change sequence. The reference change amplitude and the actual change amplitude at each time position in the continuous subsequence are aligned and arranged to form an aligned change record sequence. By comparing the reference change amplitude with the actual change amplitude at each time position along the time sequence of the alignment change record, the time position where the reference change amplitude is in the downward direction and the actual change amplitude is in the upward direction is determined, forming a set of candidate positions for abnormal rise. By combining the reference change amplitude and the actual change amplitude of adjacent time positions in the alignment change record sequence, the set of candidate abnormal rise positions is filtered point by point, and the time positions that show a decreasing relationship between the preceding and following time positions and an increasing relationship between the current time position are retained to determine the abnormal rise positions. The locations of abnormally high elevations are arranged in chronological order, and associated with time and location markers, reference change ranges, and actual change ranges to form a set of isolated impact markers; By combining isolated impact marker sets, the connection relationship between the changes before and after each abnormal rise position in the intensity change sequence is analyzed, the change segments formed by continuous changes and the inserted change segments are distinguished, and the impact insertion order is constructed. Based on the impact insertion order, the abnormal rise positions in the intensity change sequence are separated. The abnormal rise positions are removed from the intensity change sequence and the continuous change relationship is restored to obtain independent impact sequences and continuous change sequences. The subsequent intensity change sequence is processed based on the independent impact sequence and the continuously changing sequence. The rhythm of the independent impact sequence is controlled, and the overall change is adjusted synchronously based on the continuously changing sequence. The following steps are taken to process subsequent intensity change sequences based on independent impact sequences and continuously changing sequences, including rhythm control of independent impact sequences and synchronization adjustments based on continuously changing sequences: The subsequent intensity change sequence is read time-by-time and aligned with the continuous change sequence in terms of time position. At the same time, the time range is mapped with the change segments in the independent impact sequence to form the subsequent change record structure. The magnitude of changes within the corresponding time ranges of the change segments in the independent impact sequence is arranged and extended to the corresponding time positions in the subsequent intensity change sequence; By combining the change amplitude of each time position in the continuous change sequence, the direction of the time positions in the subsequent intensity change sequence that are not within the time range of the independent impact sequence is adjusted, and the connection adjustment is made for the time positions that are within the time range of the independent impact sequence; Based on the rhythm control and synchronization adjustment results, all time positions in the subsequent intensity change sequence are uniformly organized and rearranged according to time order. The time positions controlled by the rhythm of the independent impact sequence and the time positions adjusted according to the continuous change sequence are uniformly expressed, so that the entire subsequent intensity change sequence forms a continuous arrangement relationship on the time axis and forms a combination structure dominated by the continuous change sequence and supplemented by the rhythm constraint of the independent impact sequence in terms of change structure.

2. The computer network communication security monitoring method according to claim 1, characterized in that, The steps for constructing the impact insertion order are as follows: The abnormal rise locations in the isolated impact marker set are expanded in chronological order, and the corresponding time positions are located in the intensity change sequence. The communication intensity values ​​and change amplitudes of continuous time positions are read forward and backward to form a local continuous change record. By combining local continuous change records, the direction of the change amplitude before and after the abnormal rise position is sorted out, and the preceding continuous change segment and the following continuous change segment are divided. Based on the directional relationship between the change amplitude of the abnormal rise position and the preceding and following continuous change segments, the change segments formed by continuous change and the inserted change segments are determined. The temporal position of each change segment in the intensity change sequence is organized around the inserted change segments and the change segments formed by continuous changes, and the temporal connection relationship between adjacent change segments is recorded; Based on the temporal order of the inserted change segments, each change segment is numbered, and the impact insertion order is constructed by combining the temporal position with the relationship between the change segments formed by adjacent continuous changes.

3. The computer network communication security monitoring method according to claim 2, characterized in that, When dividing the preceding and following continuous change segments, the change amplitude of adjacent time positions before and after the abnormal rise position is compared point by point to determine the consistency of the change direction of the preceding and following continuous change segments. Based on the relationship between the change amplitude of the abnormal rise position and the direction of the preceding and following continuous change segments, the identification range of the inserted change segments is limited.

4. The computer network communication security monitoring method according to claim 2, characterized in that, The steps for obtaining independent impact sequences and continuously changing sequences are as follows: Based on the order of impact insertion, the inserted change segments in the intensity change sequence are located segment by segment, and the time position corresponding to each change segment is marked to form the inserted change segment segment and the unmarked continuous change segment. Around the inserted change segments, the communication intensity value and change amplitude of each segment at the time position are extracted and arranged according to the order of impact insertion to construct an independent impact sequence; Based on the extraction results of the inserted change segments, the unidentified time positions in the intensity change sequence are rearranged to form a continuous change sequence; Based on independent impact sequences and continuous change sequences, the time positions of each time location in the original intensity change sequence are recorded and the time sequence is compared and organized. Independent impact sequences and continuously changing sequences are expressed separately according to their time sequence.

5. The computer network communication security monitoring method according to claim 4, characterized in that, The inserted change segments are arranged chronologically according to the order of impact insertion, and the time position of each change segment is associated with the communication intensity value and the change amplitude. At the same time, the time position in the continuous change sequence is synchronously recorded. The time alignment expression of independent impact sequences and continuous change sequences is achieved through a unified time position identifier.

Images