Network security situation awareness and detection system and method based on cloud platform

Abstract

This invention discloses a network security situation awareness and detection system and method based on a cloud platform, relating to the field of cloud platform technology. It includes: a mapping module, which determines the C-shaped grounding loop structure based on the physical ports of the target network device and constructs a structure mapping table based on the structural design data of the target network device; a partitioning module, which partitions the encrypted handshake records of the target network device into channels based on the structure mapping table and defines the loop-side channel and the closed-loop-side channel; a statistics module, which determines the loop-side handshake success rate corresponding to the loop-side channel and the closed-loop-side handshake success rate corresponding to the closed-loop-side channel; and a judgment module, which determines the discrete grounding segment wander difference based on the loop-side handshake success rate and the closed-loop-side handshake success rate, and performs structural anomaly judgment on the physical ports to obtain structure-induced handshake anomaly ports. This invention can improve the efficiency of discovering network device structural problems.

Description

Technical Field

[0001] This invention relates to the field of cloud platform technology, and in particular to a network security situation awareness and detection system based on a cloud platform. Background Technology

[0002] With the continuous expansion of data center scale and the large-scale deployment of high-speed interface devices, target network devices such as switches and routers typically integrate multiple high-speed physical ports and achieve large-scale concurrent communication through optical modules or high-speed cables. In actual operation, in order to improve the electromagnetic shielding performance of the equipment, the interface area is usually formed by the front panel, metal cage and electromagnetic shielding pad to form a grounding connection structure to reduce the impact of external electromagnetic interference on high-speed differential signals. Under conditions such as long-term operation, hot-swappable maintenance or structural assembly deviations, the grounding connection in the interface area may experience insufficient local compression, uneven contact surface or changes in contact distribution, thus forming a grounding ring structure with an opening in the circumference. Network security situation awareness is usually based on encrypted handshake logs, traffic statistics or abnormal behavior analysis data for judgment, and is centrally processed and detected through a cloud platform. When the high-speed physical differential line is spatially close to the grounding opening in the interface area, the stability of the signal return path and the continuity of shielding will be affected, resulting in failure or retry in the encrypted handshake process. However, such anomalies often manifest as ordinary communication fluctuations at the logical level, making it difficult to directly establish a correspondence with the structural status.

[0003] Existing network security situational awareness technologies mainly focus on abnormal traffic behavior, abnormal protocol interaction, or attack behavior characteristics. They lack an analysis mechanism for the impact of changes in the circumferential grounding structure of the underlying physical port on the success rate of encrypted handshakes. It is difficult to link the spatial distribution differences in the handshake success rate with the distribution of the interface grounding structure. When the physical port causes differences in the handshake success probability due to uneven circumferential distribution of the grounding structure, existing technologies usually regard it as a link quality problem or random fluctuation. It is difficult to identify it in a timely manner as a structural anomaly caused by changes in the interface grounding structure, resulting in insufficient detection accuracy. Furthermore, it is impossible to form detection records and traceability evidence for structural problems on the cloud platform side. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies that make it difficult to promptly identify structural anomalies caused by changes in interface grounding structure, and to propose a cloud-based network security situation awareness and detection system and method.

[0005] To address the problems existing in the prior art, the present invention adopts the following technical solution: A cloud-based network security situation awareness and detection system includes: The mapping module determines the C-shaped grounding ring structure based on the physical port of the target network device, and constructs a structure mapping table based on the structural design data of the target network device. The module is divided into channels based on the structure mapping table, and the encrypted handshake records of the target network device are divided into channels, and the loop gap side channel and the closed loop side channel are defined. The statistics module determines the handshake success rate of the annular gap side channel and the handshake success rate of the closed loop side channel. The judgment module determines the wander difference of the discrete grounding segment based on the handshake success ratio on the annular gap side and the handshake success ratio on the closed loop side, and performs structural anomaly judgment on the physical port to obtain the structural induced handshake anomaly port. The detection module detects the target network device based on the structure detection records corresponding to the structure-induced handshake anomaly port.

[0006] Preferably, the C-shaped grounding ring structure is defined as follows: Determine the physical port of the target network device; Configure the port identifier and channel identifier of the physical port; The grounding structure formed by the front panel, metal cage, and electromagnetic shielding pad of the target network device is defined as a C-shaped grounding ring structure.

[0007] Preferably, constructing a structure mapping table includes: Obtain the structural design data of the target network device; the structural design data includes the routing positions of physical differential lines on the printed circuit board; The gap formed by the lack of pressing on one side of the C-shaped grounding ring structure is defined as an open gap; Based on the structural design data, the positional relationship of the physical differential line corresponding to each channel identifier relative to the C-shaped grounding ring gap structure is determined; the positional relationship includes the side closer to the gap and the side farther from the gap. Record the positional relationship of the side closest to the opening as the structural mark of the circumferential seam side; Record the positional relationship on the side furthest from the seam as the closed-loop side structural marker; A structural mapping table is constructed based on the structural markers on the circumferential seam side and the closed-loop side.

[0008] Preferably, defining the annular suture side channel and the closed-loop side channel includes: Collect encrypted handshake records from the target network device; Based on the port identifier and channel identifier in the encrypted handshake record, the corresponding structure tag is searched in the structure mapping table and used as the structure label of the encrypted handshake record; Store the encrypted handshake record with the structural label as the annular seam side structure mark into the first buffer queue; Store the encrypted handshake record with the structure label of the closed-loop side structure into the second buffer queue; Define the first buffer queue as the annular seam side channel; Define the second buffer queue as a closed-loop side channel.

[0009] Preferably, determining the handshake success rate on the annular seam side and the handshake success rate on the closed loop side includes: Count the total number of ring-seam handshake sessions identified for each port in the ring-seam side channel; Count the number of successful handshake sessions on the ring-seam side in the ring-seam side channel for each port identifier; Count the total number of closed-loop handshake sessions for each port identifier in the closed-loop channel; Count the number of successful closed-loop handshake sessions for each port in the closed-loop channel; The success rate of the ring-seam handshake is determined based on the number of successful handshake sessions on the ring-seam side and the total number of handshake sessions on the ring-seam side; the success rate of the closed-loop handshake is determined based on the number of successful handshake sessions on the closed-loop side and the total number of handshake sessions on the closed-loop side.

[0010] Preferably, determining the wander difference of discrete grounding segments includes: The average handshake success rate is determined based on the handshake success rate on the annular side and the handshake success rate on the closed-loop side. Based on the average handshake success rate, the handshake success rate on the annular seam side is corrected for wandering to obtain the handshake success rate on the wandering disturbed side. Based on the average handshake success rate, a shift correction is performed on the handshake success rate on the closed-loop side to obtain the handshake success rate on the shift-maintain side. The migration difference of discrete grounding segments is determined based on the handshake success ratio of the disturbed side and the handshake success ratio of the maintained side.

[0011] Preferably, the structure-induced handshake anomaly port includes: Based on the multiple discrete grounding segments in the C-shaped grounding ring structure, determine the circumferential discrete grounding segments of the ring; Obtain the site information of the circumferential discrete grounding section of the annular joint; Obtain the number of the first discrete grounding segments from the site information; Obtain the number of second discrete grounding segments from the site information; When the wander difference of discrete ground segments is positive and the number of second discrete ground segments is greater than the number of first discrete ground segments, the physical port is identified as a structure-induced handshake abnormal port.

[0012] Preferably, the target network device is tested, including: Set an exception flag for the structure-induced handshake exception port; Send the anomaly marker to the cloud platform; In the cloud platform, structural detection records are generated based on anomaly markers; Based on the structural inspection records, the target network device is inspected.

[0013] To address the aforementioned problems, this invention also provides a cloud-based network security situation awareness and detection method, the method comprising: The C-shaped grounding ring structure is determined based on the physical ports of the target network device, and a structure mapping table is constructed based on the structural design data of the target network device. Based on the structure mapping table, the encrypted handshake records of the target network device are divided into channels, and the loop gap side channel and the closed loop side channel are defined. Determine the handshake success rate of the annular gap side channel and the handshake success rate of the closed loop side channel. The wander difference of discrete grounding segments is determined based on the handshake success ratio on the annular gap side and the handshake success ratio on the closed loop side, and the physical port is judged for structural anomalies to obtain the structural induced handshake anomaly port. The target network device is detected based on the structure detection record corresponding to the structure-induced handshake anomaly port.

[0014] Compared with the prior art, the beneficial effects of the present invention are: 1. In this invention, the grounding connection structure formed by the front panel, metal cage and electromagnetic shielding pad at the physical port of the target network device is defined as a C-shaped grounding ring gap structure. A structure mapping table is constructed in combination with the routing position of the physical differential lines on the printed circuit board, so that each channel identifier can be established in correspondence with its spatial relationship relative to the gap position. This enables the correlation analysis between communication data and interface grounding structure, and the subsequent handshake data statistics can reflect the transmission stability of channels in different spatial positions.

[0015] 2. In this invention, the encrypted handshake record is divided into channels to form a ring gap side channel and a closed loop side channel. The handshake success ratios of the two types of channels are statistically analyzed. Then, the wandering correction is performed by the average handshake success ratio to obtain the handshake success ratio of the wandering disturbed side and the handshake success ratio of the wandering maintained side. In addition, the wandering difference of the discrete grounding segment is calculated, so that the impact of the interface circumferential grounding structure change on the signal transmission stability can be quantitatively expressed, and the accuracy of structural anomaly identification is improved.

[0016] 3. In this invention, by combining the differential displacement of discrete grounding segments and the number distribution of discrete grounding segments in the circumferential direction of the ring gap, the physical port is structurally abnormal and an anomaly mark is generated. Then, the cloud platform generates a structural detection record and guides the target network device to perform detection, so that the network-side handshake anomaly data can establish a correspondence with the device structural status, thereby realizing the rapid identification and location of structurally induced handshake anomaly ports and improving the efficiency of discovering network device structural problems. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating a cloud-based network security situation awareness and detection method according to an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] This embodiment provides a network security situation awareness and detection system based on a cloud platform. Specifically, it includes a mapping module that determines the C-shaped grounding ring structure based on the physical port of the target network device and constructs a structure mapping table based on the structural design data of the target network device. In an embodiment of the present invention, determining the C-shaped grounding ring gap structure includes: Determine the physical port of the target network device; The target network device refers to the physical device that performs data exchange or forwarding functions in the network system, such as a switch, router, or network node device with a high-speed interface. This device is equipped with multiple physical ports. The physical port refers to the actual electrical connection interface set on the shell or front panel of the target network device, which is used to connect optical modules, cables or other communication media and complete the input and output of electrical or optical signals.

[0020] Obtain the structural and interface installation data of the target network device. The structural data includes at least the distribution of openings on the front panel, the mounting positions of the metal cages corresponding to each opening, and the arrangement of connectors on the printed circuit board that connect to each opening. Then, inspect the front panel of the target network device one by one, identifying the actual location of each opening used to install a communication interface module, and confirming whether a corresponding metal cage and electrical connection components are fixedly installed behind each opening. Next, trace the corresponding electrical connection path from the location of each opening into the device, confirming whether the opening is connected to the data transmission path on the printed circuit board through connectors, pads, and conductive lines. For existing... Once it is confirmed that there is an actual interface installation location, a corresponding metal cage, and an opening that is conductive to the printed circuit board, the opening and its corresponding installation part are identified as a physical port. Each identified physical port is arranged and recorded according to its spatial position on the front panel to form a physical port list. The physical port list should at least record the position of each physical port on the front panel, the position of the corresponding metal cage, and the positional relationship with the printed circuit board. Then, the physical port list is compared item by item with the interface installation positions in the structural data to uniquely confirm each physical port on the front panel, thereby obtaining all the physical ports of the target network device.

[0021] Configure the port identifier and channel identifier of the physical port; Port identifiers are unique numbering information used to distinguish different physical ports and are used to locate the corresponding ports in the internal logic and management system of the device; channel identifiers are numbering information used to identify different high-speed signal channels or differential channels within the same physical port and are used to distinguish the various signal paths in a multi-channel transmission structure.

[0022] Based on the established physical port list, each physical port is numbered according to its arrangement on the front panel. The arrangement order can be from left to right or from top to bottom, thus assigning a unique port identifier to each physical port. After completing the port identifier setting, the printed circuit board routing data corresponding to each physical port is read to identify the independent high-speed differential channels extending from the electrical connection components of that physical port into the printed circuit board, and to confirm the correspondence between each differential channel and that physical port. Subsequently, within the same physical port, each differential channel is numbered sequentially according to its arrangement at the connector end or its actual routing order on the printed circuit board, thus assigning a unique channel identifier to each differential channel.

[0023] The grounding structure formed by the front panel, metal cage, and electromagnetic shielding pad of the target network device is defined as a C-shaped grounding ring structure.

[0024] The front panel refers to the metal panel structure on the outer shell of the target network device used to install and fix physical port components; the metal cage refers to the metal frame structure installed at the opening of the front panel to fix optical modules or interface modules, and to provide mechanical support and electromagnetic shielding path for the interface modules; the electromagnetic shielding pad refers to the conductive elastic material placed between the metal cage and the front panel, whose function is to form a continuous conductive contact to enhance grounding continuity and electromagnetic shielding effect; the grounding structure refers to the conductive connection path formed between the front panel, the metal cage and the electromagnetic shielding pad, used to guide the electromagnetic energy of the interface area into the device grounding system.

[0025] The C-shaped grounding ring structure refers to a grounding connection structure formed by the front panel of the target network device, the metal cage for installing the interface module, and the electromagnetic shielding pad located between the two. When the grounding connection structure maintains conductive contact in most areas of the interface circumference, but forms gaps in some areas due to insufficient pressing of the electromagnetic shielding pad, installation gaps, or structural deformation, the grounding connection structure presents a combination of a continuous conductive area and a gapped area in the circumference. The conductive area is distributed circumferentially and forms an approximately loop-shaped conductive path around the interface, while the gapped area makes the loop-shaped conductive path present an opening structure similar to the letter C. The grounding ring structure formed in this way is the C-shaped grounding ring structure. This structure describes a spatial distribution pattern in which the interface grounding area coexists with circumferential conductivity and local gaps.

[0026] In an embodiment of the present invention, constructing a structure mapping table includes: Obtain the structural design data of the target network device; the structural design data includes the routing positions of physical differential lines on the printed circuit board; Specifically, the relevant design data for the equipment is read and organized. The structural design data comes from the equipment's hardware design documents, printed circuit board (PCB) layout data, and interface installation drawings. By reading the PCB layout file, the actual distribution path of each physical differential line on the PCB surface is identified, and the routing direction, layer, and corresponding connection position of these differential lines after exiting the interface connector are recorded. Simultaneously, based on the connection relationship between the interface connector and the PCB, each physical differential line is matched with its corresponding communication channel, thus forming a data set containing the spatial distribution location of physical differential lines, connection paths, and channel correspondences. This data set serves as the structural design data for the target network device, describing the actual electrical connection layout between the interface area and the PCB.

[0027] The gap formed by the lack of pressing on one side of the C-shaped grounding ring structure is defined as an open gap; A slot refers to a gap area in a C-shaped grounding ring structure where a conductive connection is not formed due to local contact. This area creates an opening in the circumferential direction of the grounding ring.

[0028] After identifying the grounding connection structure of the target network device interface area, the circumferential contact of this grounding connection structure is checked. This grounding connection structure consists of a front panel, a metal cage installed at an opening in the front panel, and an electromagnetic shielding pad located between the two. When these components maintain conductive contact over most of the circumferential area, but an uncontacted area forms on one side due to insufficient compression, this uncontacted area appears as a gap along the circumference. By recording the location of this gap and confirming that the grounding connection corresponding to this gap does not form a continuous conductive path, the gap formed by insufficient compression can be identified as an opening, thus clarifying that there is an opening in the grounding structure in the circumferential direction.

[0029] Based on the structural design data, the positional relationship of the physical differential line corresponding to each channel identifier relative to the C-shaped grounding ring gap structure is determined; the positional relationship includes the side closer to the gap and the side farther away from the gap. The structural design data of the target network device is read. This data includes at least the routing position of each physical differential line on the printed circuit board, the correspondence between each physical differential line and its corresponding channel identifier, the position of the front panel opening, the installation position of the metal cage, and the circumferential position of the slot. Then, the physical differential lines corresponding to each channel identifier are located one by one to determine the actual path of the physical differential line after it enters the printed circuit board from the interface connection. Next, using the slot location as a reference, the distribution orientation of the physical differential line in the interface area is checked to confirm whether the physical differential line is located closer to the slot or further away. After determining the correspondence of one channel identifier, the same search, location, and orientation confirmation are performed for the physical differential line corresponding to the next channel identifier. This process is repeated to confirm the positional relationship between all channel identifiers and their corresponding physical differential lines, thus obtaining the positional relationship result of the physical differential line corresponding to each channel identifier relative to the C-shaped grounding ring slot structure.

[0030] Record the positional relationship of the side closest to the opening as the structural mark of the circumferential seam side; The circumferential seam side structure mark refers to the information recorded to indicate the spatial position of the physical differential line on the side closest to the seam opening area.

[0031] After obtaining the positional relationship results corresponding to each channel identifier, the physical differential lines located near the opening side are selected. For each selected physical differential line, its corresponding channel identifier is read, and the annular seam side structure mark is written into the record of the channel identifier. The writing process includes adding a position attribute field to the data record corresponding to the channel identifier, and explicitly recording the content of the position attribute field as the annular seam side structure mark. Then, the channel identifiers that have been written with the annular seam side structure mark are checked item by item with the corresponding physical differential line positions to confirm that the physical differential line corresponding to the channel identifier is indeed located near the opening side.

[0032] Record the positional relationship on the side furthest from the seam as the closed-loop side structural marker; The closed-loop side structure marker refers to the information recorded to indicate the location of the physical differential line on the side spatially far from the seam area.

[0033] After completing the recording of the positional relationships on the side closest to the seam, the remaining channel identifiers that were not recorded as circumferential seam side structural markers are checked to determine whether the physical differential lines corresponding to these channel identifiers are located on the side far from the seam. For each physical differential line confirmed to be located on the side far from the seam, its corresponding channel identifier is read, and the closed-loop side structural marker is written into the record item of that channel identifier. The writing process includes recording the position attribute field as the closed-loop side structural marker in the data record corresponding to the channel identifier. After all the channel identifiers on the side far from the seam are recorded, the recording results of the circumferential seam side structural markers and the closed-loop side structural markers are summarized and organized. It is checked that each channel identifier corresponds to only one positional relationship record, and there are no duplicate records or missing records. In this way, the recording of the positional relationships corresponding to all channel identifiers is completed, providing a complete data foundation for the subsequent construction of the structural mapping table.

[0034] A structural mapping table is constructed based on the structural markers on the circumferential seam side and the closed-loop side.

[0035] The structure mapping table is a data record table used to record the correspondence between each channel identifier and its corresponding position. Through this data record table, the positional distribution of each physical differential line relative to the opening area of ​​the C-shaped grounding ring gap structure can be determined.

[0036] Read all channel identifier data that have been recorded in position relationship. The channel identifier data includes at least the port identifier corresponding to the physical port, the channel identifier corresponding to each physical differential line, and the annular gap side structure mark or closed loop side structure mark corresponding to the channel identifier. Then, classify all channel identifier data according to the port identifier and organize the channel identifiers belonging to the same physical port into the same port dataset. Then, in each port dataset, the positional relationship record corresponding to each channel identifier is read one by one, and the channel identifier is associated with its corresponding annular seam side structure mark or closed loop side structure mark. After completing the correspondence between all channel identifiers and structure marks within the same physical port, a structure mapping record item for that physical port is generated. The structure mapping record item includes at least the port identifier, the channel identifier, and the structure mark corresponding to the channel identifier. Then, the same data processing and correspondence establishment operations are performed on all physical ports to form a structure mapping record set covering all physical ports. Finally, the structure mapping record set is arranged in the hierarchical order of port identifiers and channel identifiers to form a structure mapping table.

[0037] The module is divided into channels based on the structure mapping table, and the encrypted handshake records of the target network device are divided into channels, and the loop gap side channel and the closed loop side channel are defined. In embodiments of the present invention, a circumferential seam side channel and a closed-loop side channel are defined, including: Collect encrypted handshake records from the target network device; An encrypted handshake record refers to the handshake interaction information generated and recorded by the device during the establishment of a communication link. This record reflects the data exchange process between the two communicating parties when establishing an encrypted communication connection.

[0038] A handshake record collection location is established on the data transmission and reception path corresponding to the physical port of the target network device, so that the communication data of the handshake phase passing through the physical port can be read. Then, data records related to the encrypted connection establishment process are continuously read from the collection location, and the record content used to characterize the handshake process is extracted from each data record. Next, the extracted record content is organized to form encrypted handshake records, and the port identifier and channel identifier to which the record belongs are written into each encrypted handshake record. The port identifier is used to indicate the physical port corresponding to the encrypted handshake record, and the channel identifier is used to indicate the physical differential line channel corresponding to the encrypted handshake record. After the port identifier and channel identifier are written, each encrypted handshake record is saved in the order of record generation to form an encrypted handshake record set corresponding to the actual communication process of the target network device.

[0039] Based on the port identifier and channel identifier in the encrypted handshake record, the corresponding structure tag is searched in the structure mapping table and used as the structure label of the encrypted handshake record; The structural marker refers to the spatial location record information used to indicate the position of the physical differential line relative to the opening position of the grounding ring gap structure; the structural tag refers to the location attribution information extracted from the structural mapping table and attached to the encrypted handshake record, used to indicate the location of the physical differential line corresponding to the handshake record.

[0040] The process begins by reading the structure mapping table, which contains the structure tags corresponding to each channel identifier under each port identifier. Then, each acquired encrypted handshake record is read sequentially. The port identifier and channel identifier are extracted from the current encrypted handshake record and used as a joint lookup item in the structure mapping table. When a record matching the current port identifier and channel identifier is found in the structure mapping table, the corresponding structure tag is read. This structure tag is then written to the current encrypted handshake record, and a new structure label field is added to the record, ensuring its content matches the structure tag. This process of extraction, lookup, reading, and writing is repeated for the next encrypted handshake record until all encrypted handshake records have their structure tags written, thus ensuring that each encrypted handshake record carries a structure tag corresponding to its physical differential line position.

[0041] Store the encrypted handshake record with the structural label as the annular seam side structure mark into the first buffer queue; Store the encrypted handshake record with the structure label of the closed-loop side structure into the second buffer queue; The first buffer queue refers to the data storage area used to temporarily store encrypted handshake records with the same structure tag; the second buffer queue refers to the data storage area used to temporarily store encrypted handshake records corresponding to another type of structure tag.

[0042] Read all encrypted handshake records that have completed the writing of structure tags, and extract the structure tag field, port identifier, channel identifier, and handshake content corresponding to each encrypted handshake record; then establish a first buffer queue and a second buffer queue, wherein the first buffer queue is used to store encrypted handshake records with the structure tag being the ring-seam side structure mark, and the second buffer queue is used to store encrypted handshake records with the structure tag being the closed-loop side structure mark; Then, following the reading order of the encrypted handshake records, the content of the structure tag field is checked one by one. When the content of the structure tag field in the current encrypted handshake record is the ring-seam side structure mark, the encrypted handshake record is completely written to the first buffer queue, and the corresponding port identifier, channel identifier, structure tag, and handshake content are saved in the first buffer queue in the order of writing. When the content of the structure tag field in the current encrypted handshake record is the closed-loop side structure mark, the encrypted handshake record is completely written to the second buffer queue, and the corresponding port identifier, channel identifier, structure tag, and handshake content are saved in the second buffer queue in the order of writing. After completing the queue writing of one encrypted handshake record, the same structure tag reading, tag content checking, and queue writing operation is performed on the next encrypted handshake record until all encrypted handshake records are classified and stored.

[0043] Define the first buffer queue as the annular seam side channel; Define the second buffer queue as a closed-loop side channel.

[0044] The annular gap side channel refers to the set of signal channels consisting of encrypted handshake records corresponding to all annular gap side structure markers; the closed loop side channel refers to the set of signal channels consisting of encrypted handshake records corresponding to all closed loop side structure markers.

[0045] It should be noted that since the physical differential line corresponding to the structural mark on the annular gap side is located near the open gap, while the physical differential line corresponding to the structural mark on the closed loop side is located far from the gap, storing the encrypted handshake records with the structural mark on the annular gap side in the first buffer queue can form a data set reflecting the signal transmission situation near the open gap area; at the same time, storing the encrypted handshake records with the structural mark on the closed loop side in the second buffer queue can form a data set reflecting the signal transmission situation far from the gap area. By defining the two types of encrypted handshake records as the annular gap side channel and the closed loop side channel respectively, communication data from different spatial locations can be clearly distinguished in subsequent processing, thereby enabling the analysis of the impact of the grounding annular gap structure on the communication process based on the differences between the data on both sides.

[0046] The statistics module determines the handshake success rate of the annular gap side channel and the handshake success rate of the closed loop side channel. In embodiments of the present invention, determining the handshake success rate on the annular gap side and the handshake success rate on the closed loop side includes: Count the total number of ring-seam handshake sessions identified for each port in the ring-seam side channel; The total number of handshake sessions on the annular seam side refers to the number of all handshake session records obtained in the annular seam side channel. This number represents the total number of handshake processes used to establish a communication connection through the physical differential line near the seam side.

[0047] All encrypted handshake records in the annular gap side channel are retrieved, and then categorized according to port identifiers. Encrypted handshake records with the same port identifier are grouped into the same port record set. After categorization, session identifiers in each port record set are read one by one, and the encrypted handshake records are merged according to the session identifiers, so that multiple encrypted handshake records belonging to the same session identifier are identified as the same handshake session. Then, all handshake sessions obtained after session merging in each port record set are counted one by one, and the count result is recorded as the total number of annular gap side handshake sessions in the annular gap side channel for that port identifier.

[0048] Count the number of successful handshake sessions on the ring-seam side in the ring-seam side channel for each port identifier; The number of successful handshake sessions on the annular seam side refers to the number of handshake records that complete the communication establishment process in the annular seam side channel. This number represents the number of times a communication connection has been successfully established in the signal transmission path near the seam side.

[0049] Based on the completion of port classification and session merging, the handshake session record corresponding to each port identifier is read one by one, and the handshake process record content corresponding to each handshake session is checked. Then, based on the handshake process record content, it is determined whether the handshake session has completed the handshake establishment process. The determination process includes checking whether there is a record in the handshake session indicating that the handshake is completed, and confirming that the handshake session has not been marked as a handshake interruption or handshake failure. For handshake sessions that have been confirmed to have completed the handshake establishment process, they are recorded as a successful handshake session, and a record is added to the successful session count item corresponding to the port identifier. For handshake sessions that have not completed the handshake establishment process, they are not counted in the number of successful handshake sessions. After completing the check of all handshake sessions corresponding to a port identifier, the count result is recorded as the number of successful handshake sessions on the ring seam side in the ring seam side channel for that port identifier.

[0050] Count the total number of closed-loop handshake sessions for each port identifier in the closed-loop channel; The total number of handshake sessions on the closed-loop side refers to the number of all handshake session records obtained in the closed-loop channel. This number represents the total number of handshake processes used to establish a communication connection through the physical differential line on the far-off side.

[0051] All encrypted handshake records in the closed-loop channel are read. Each encrypted handshake record in the closed-loop channel contains at least a port identifier, a session identifier, and the handshake process record content. Then, all encrypted handshake records are classified according to the port identifier, and encrypted handshake records with the same port identifier are grouped into the same port record set. After the port classification is completed, the session identifier in each port record set is read one by one, and multiple encrypted handshake records belonging to the same session identifier are merged based on the session identifier, so that multiple records corresponding to the same communication connection establishment process are grouped into one handshake session. Then, all the merged handshake sessions in each port record set are counted one by one, and the count result is recorded as the total number of closed-loop handshake sessions for that port identifier in the closed-loop channel.

[0052] Count the number of successful closed-loop handshake sessions for each port in the closed-loop channel; The number of successful handshake sessions on the closed-loop side refers to the number of handshake records that complete the communication establishment process in the closed-loop channel. This number represents the number of times a communication connection has been successfully established in the signal transmission path on the side away from the seam.

[0053] Based on the completion of closed-loop handshake session merging, each handshake session corresponding to each port identifier is read one by one. Then, based on the handshake process record content, it is determined whether the handshake session has completed the communication connection establishment process. The determination process includes confirming that there are records indicating that the handshake is completed in the handshake session, and confirming that there are no records indicating that the handshake has failed, been interrupted, or terminated. For handshake sessions that have confirmed that the communication connection establishment process has been completed, they are recorded as a closed-loop side handshake success session, and an entry is added to the success session count item corresponding to the port identifier. For handshake sessions that have not completed the communication connection establishment process, they are not counted in the number of closed-loop side handshake success sessions. After completing the check of all handshake sessions corresponding to a port identifier, the count result is recorded as the number of closed-loop side handshake success sessions for that port identifier in the closed-loop side channel.

[0054] The ring-seam handshake success ratio is determined based on the number of successful ring-seam handshake sessions and the total number of ring-seam handshake sessions. The success rate of handshake on the seam side refers to the ratio between the number of successful handshake sessions on the seam side and the total number of handshake sessions on the seam side. It is used to indicate the degree of success in establishing a communication connection on the signal path closer to the seam side.

[0055] The closed-loop handshake success rate is determined based on the number of successful handshake sessions on the closed-loop side and the total number of handshake sessions on the closed-loop side.

[0056] The closed-loop handshake success ratio refers to the ratio between the number of successful closed-loop handshake sessions and the total number of closed-loop handshake sessions. It is used to indicate the degree of success in establishing a communication connection on the signal path away from the seam.

[0057] Read the number of successful ring-gap handshake sessions and the total number of ring-gap handshake sessions corresponding to each port identifier; then calculate the ratio using the number of successful ring-gap handshake sessions as the numerator and the total number of ring-gap handshake sessions as the denominator; then record the calculated result as the ring-gap handshake success ratio corresponding to that port identifier; read the number of successful closed-loop handshake sessions and the total number of closed-loop handshake sessions corresponding to each port identifier; then calculate the ratio using the number of successful closed-loop handshake sessions as the numerator and the total number of closed-loop handshake sessions as the denominator; then record the calculated result as the closed-loop handshake success ratio corresponding to that port identifier.

[0058] During the establishment of a communication link, each handshake session corresponds to a complete signal transmission and feedback confirmation process. The number of successful handshake sessions indicates the number of times a communication connection has been successfully established through this signal path within a certain period of time, while the total number of handshake sessions indicates the total number of attempts to establish a communication connection within the same time range. Therefore, the ratio between the two can reflect the communication reliability of this signal path in the actual signal propagation environment. When the physical differential line is close to the open area of ​​the grounding ring gap structure, the grounding continuity is reduced and the local shielding capability is weakened. The signal is more susceptible to external electromagnetic interference or additional coupling during propagation, which may cause some handshake processes to fail. On the other hand, the differential line on the side away from the gap has a continuous grounding path and better shielding conditions, resulting in a relatively higher degree of signal propagation stability. Therefore, the number of times a communication connection is successfully established accounts for a relatively large proportion of all attempts. By calculating the ratio of the number of successful handshake sessions to the total number of handshake sessions, we can obtain a ratio representing the degree of communication success of the signal path. This ratio directly reflects the stability of signal transmission under the current structural conditions.

[0059] The judgment module determines the wander difference of the discrete grounding segment based on the handshake success ratio on the annular gap side and the handshake success ratio on the closed loop side, and performs structural anomaly judgment on the physical port to obtain the structural induced handshake anomaly port. In embodiments of the present invention, determining the discrete grounding segment shift difference includes: The average handshake success rate is determined based on the handshake success rate on the annular side and the handshake success rate on the closed-loop side. The average handshake success rate is a ratio calculated by combining the handshake success rate on the ring gap side and the handshake success rate on the closed loop side. It is used to represent the average level of overall communication success at the same physical port under the signal paths on both sides.

[0060] Based on the average handshake success rate, the handshake success rate on the annular seam side is corrected for wandering to obtain the handshake success rate on the wandering disturbed side. Wandering correction refers to normalizing the handshake success rate of channels at different spatial locations using the average handshake success rate, so that channels at different locations can be compared under the same reference level; the wandering interference-side handshake success rate refers to the handshake success rate of the channel near the gap area after wandering correction processing. This ratio is used to indicate the degree of communication success after being affected by electromagnetic interference near the grounding discontinuity area.

[0061] Read the handshake success ratio on the ring gap side and the handshake success ratio on the closed loop side corresponding to the same physical port, and confirm that the two ratios correspond to the same statistical period under the same port identifier; then sum the handshake success ratio on the ring gap side and the handshake success ratio on the closed loop side to obtain the total handshake success rate of the physical port on both sides within the statistical period; then divide the total value by two to obtain the average handshake success ratio corresponding to the physical port, and write the average handshake success ratio into the data record item corresponding to the port identifier; after determining the average handshake success ratio, read the handshake success ratio on the ring gap side and the average handshake success ratio corresponding to the physical port, divide the handshake success ratio on the ring gap side by the average handshake success ratio to obtain the ratio after wander correction, and record the wander correction ratio as the handshake success ratio on the wandering disturbed side.

[0062] It needs to be explained that "shift" refers to the phenomenon where changes in the spatial distribution of the grounding conduction path cause a shift in the signal propagation environment, resulting in a relative change in the degree of communication success. When the grounding structure of the interface area has gaps or discrete grounding sections in the circumferential direction, the effective position of the signal return path will shift along the grounding structure, thus causing a difference in the signal propagation stability between the side closer to the gap and the side farther away from the gap. This relative change in the degree of signal transmission stability caused by changes in the grounding path distribution is called shift. By correcting the handshake success ratio on the gap side by averaging the handshake success ratio, the influencing factors of the overall communication environment are unified to the same reference level, thereby highlighting the shift in the degree of handshake success caused by changes in the grounding path distribution.

[0063] Based on the average handshake success rate, a shift correction is performed on the handshake success rate on the closed-loop side to obtain the handshake success rate on the shift-maintain side. The migration difference of discrete grounding segments is determined based on the handshake success ratio of the disturbed side and the handshake success ratio of the maintained side.

[0064] The discrete grounding segment wandering difference refers to the value calculated based on the difference between the handshake success rate on the wandering disturbance side and the handshake success rate on the wandering holding side. This value is used to reflect the change in signal path stability caused by the uneven distribution of discrete grounding segments in the grounding ring gap structure.

[0065] Read the closed-loop handshake success ratio and average handshake success ratio corresponding to the same physical port, and confirm that the closed-loop handshake success ratio and average handshake success ratio correspond to the same port identifier and the same statistical period; then divide the closed-loop handshake success ratio by the average handshake success ratio to obtain the wander correction result of the physical port in the statistical period, and record the wander correction result as the wander holding side handshake success ratio; continue to read the wander disturbed side handshake success ratio and wander holding side handshake success ratio corresponding to the physical port, and confirm that the wander disturbed side handshake success ratio and wander holding side handshake success ratio correspond to the same port identifier and the same statistical period; then subtract the wander disturbed side handshake success ratio from the wander holding side handshake success ratio to obtain the wander difference of the discrete grounding segment corresponding to the physical port.

[0066] When there are discrete grounding sections in the C-shaped grounding ring gap structure, the grounding conduction path is no longer continuous in the circumferential direction, and the effective length and distribution position of the conductive path change, resulting in differences in the signal propagation environment between the side near the gap and the side far from the gap. According to the general laws of electromagnetic propagation and circuit transmission, the intensity of interference encountered by the signal during propagation, the stability of the grounding return path, and the continuity of shielding jointly affect the success probability of communication establishment. Therefore, the handshake success ratio can reflect the transmission stability of the channel at different spatial locations. The average handshake success ratio reflects the average success level under overall communication conditions at the same port. By normalizing the handshake success ratios of each side with the average handshake success ratio, the influence of changes in overall communication load or equipment operating status on the results can be eliminated, allowing the differences between channels at different locations to be compared under a unified reference level. After obtaining the handshake success ratios of the wandering disturbed side and the wandering hold side, the difference between the two directly reflects the difference in transmission stability caused by the uneven distribution of discrete grounding segments. This difference originates from the changes in electromagnetic interference coupling caused by the discontinuity of the grounding path and the offset of the return path. Therefore, the value obtained by subtracting the handshake success ratio of the wandering disturbed side from the handshake success ratio of the wandering hold side can quantify the signal stability shift caused by the circumferential distribution change of discrete grounding segments, thereby obtaining the wandering difference of discrete grounding segments.

[0067] In an embodiment of the present invention, a structure-induced handshake anomaly port is obtained, including: Based on the multiple discrete grounding segments in the C-shaped grounding ring structure, determine the circumferential discrete grounding segments of the ring; Discrete grounding segments refer to several grounding areas that actually form conductive contacts in the grounding ring structure. Each discrete grounding segment is formed by the conductive contact between the metal cage and the front panel and undertakes part of the signal return path. A circumferential discrete grounding segment refers to several independent grounding segments along the circumferential path of a C-shaped grounding ring structure, where conductive contact is formed between the front panel, the metal cage, and the electromagnetic shielding pad. These grounding segments are spaced apart circumferentially, with gaps between adjacent segments where no conductive connection is formed. This results in the grounding conduction path appearing as multiple dispersed conductive areas circumferentially. Because the circumferential arrangement of each discrete grounding segment is different, when the signal return path propagates along the C-shaped grounding ring structure, the distribution of the actual conductive and non-conductive areas in the circumferential direction changes the continuous position of the grounding conduction path. This causes the originally fixed opening position to shift circumferentially in an equivalent sense. Therefore, this alternating distribution structure of conduction and gaps formed by multiple discrete grounding segments in the circumferential direction is defined as a circumferential discrete grounding segment.

[0068] Obtain grounding connection and structural data for the target network device interface area. This data should include at least the actual contact distribution of the front panel, metal cage, and electromagnetic shielding pad in the circumferential direction of the interface. Then, continuously check the conductive contact status at each location along the circumferential path of the C-shaped grounding ring structure, identifying the contact segments that actually form conductive connections along this circumferential path, and recording each continuously conductive contact segment as a discrete grounding segment. Continue to check the interval segments between discrete grounding segments that do not form conductive connections, confirming the circumferential distribution of these interval segments, and determining whether the discrete grounding segments and interval segments are arranged alternately along the circumferential direction. When multiple discrete grounding segments are dispersed along the circumferential direction of the C-shaped grounding ring structure, and different discrete grounding segments are separated by non-conductive segments, causing a redistribution of the actual conductive and non-conductive positions of the C-shaped grounding ring structure in the circumferential direction, the grounding structure formed by multiple discrete grounding segments that can cause the equivalent opening position to change circumferentially is identified as the ring-shaped circumferential discrete grounding segment.

[0069] Obtain the site information of the circumferential discrete grounding section of the annular joint; Site information refers to the data records that describe the positional relationship of each discrete grounding segment in the circumferential direction of the grounding ring and the corresponding regional distribution.

[0070] Read the established records of discrete grounding segments in the circumferential direction of the grounding ring, and retrieve the circumferential distribution data of each discrete grounding segment constituting the record one by one; then record the starting and ending positions of each discrete grounding segment on the circumferential path of the C-shaped grounding ring structure, record whether it is located near the opening side or far from the opening side, and record its circumferential arrangement order among all discrete grounding segments; then continue to record the corresponding positions of the interval segments between each discrete grounding segment in the circumferential direction, so that the circumferential relationship between each discrete grounding segment and its adjacent non-conductive segment can be clearly represented; classify and organize the above records according to the physical port to form a site information record corresponding to the corresponding physical port. The site information record includes at least the side affiliation, circumferential arrangement order, circumferential coverage area, and positional relationship of adjacent interval segments for each discrete grounding segment.

[0071] Obtain the number of the first discrete grounding segments from the site information; Obtain the number of second discrete grounding segments from the site information; The first discrete grounding segment count refers to the number of discrete grounding segments located in the area close to the opening side, which is statistically obtained from the site information; the second discrete grounding segment count refers to the number of discrete grounding segments located in the area far from the opening side, which is statistically obtained from the site information.

[0072] Read the site information record corresponding to the physical port of the target network device. The site information record includes at least the side assignment information of each discrete grounding segment and the positional relationship between each discrete grounding segment and the slot location. Then, read the record content of each discrete grounding segment one by one and check whether the discrete grounding segment is marked as being located near the slot. For discrete grounding segments confirmed to be located near the slot, count them one by one and record the accumulated count as the first discrete grounding segment count. After completing the counting of discrete grounding segments near the slot, continue to read the records of the remaining discrete grounding segments in the site information one by one. The content is read and counted, and each discrete grounding segment is checked to see if it is marked as being located on the side far from the seam. For discrete grounding segments confirmed to be located on the side far from the seam, they are counted one by one, and the accumulated count is recorded as the second discrete grounding segment count. After all discrete grounding segments are read and counted, the first discrete grounding segment count and the second discrete grounding segment count are recorded and saved, so that the first discrete grounding segment count corresponds to the total number of discrete grounding segments near the seam side, and the second discrete grounding segment count corresponds to the total number of discrete grounding segments far from the seam side, thereby completing the acquisition of the first discrete grounding segment count and the second discrete grounding segment count.

[0073] When the wander difference of discrete ground segments is positive and the number of second discrete ground segments is greater than the number of first discrete ground segments, the physical port is identified as a structure-induced handshake abnormal port.

[0074] Structure-induced handshake anomaly port refers to a physical port where the handshake anomaly occurs due to changes in signal transmission path stability caused by uneven distribution of discrete grounding segments in the grounding ring gap structure.

[0075] The number and distribution of discrete grounding segments in a C-shaped grounding ring structure directly affect the stability of the signal return path and the continuity of electromagnetic shielding. When the number of discrete grounding segments further away from the gap is greater than that closer to the gap, the grounding conduction area shifts significantly in the circumferential direction, making it easier for the signal return path to form stable conduction on the side further away from the gap. On the side closer to the gap, due to the smaller grounding conduction area, the continuity of the return path decreases, and the signal is more susceptible to electromagnetic leakage and external interference during propagation. Under this grounding structure distribution, the stability of signal transmission will change asymmetrically on both sides, making the communication establishment process closer to the gap more prone to failure or interruption. When the differential displacement of discrete ground segments is positive, it indicates that the signal stability calculated by the handshake success ratio has shown a shift trend caused by the distribution of ground segments. At the same time, the fact that the number of the second discrete ground segments is greater than the number of the first discrete ground segments further indicates that the grounding conduction area is concentrated on the side away from the seam in the circumferential direction. Therefore, when both of these occur at the same time, it can be determined that the handshake anomaly of the physical port is related to the distribution of the grounding structure, thus identifying the physical port as a structure-induced handshake anomaly port.

[0076] The detection module detects the target network device based on the structure detection records corresponding to the structure-induced handshake anomaly port.

[0077] In an embodiment of the present invention, detecting the target network device includes: Set an exception flag for the structure-induced handshake exception port; An anomaly marker refers to the recorded information used to identify that the physical port has been determined to be a structure-induced handshake anomaly port. This recorded information corresponds one-to-one with the corresponding port identifier and is used to indicate that the port has a communication anomaly caused by the grounding structure distribution.

[0078] Read the physical port records that have completed the structural anomaly determination, and extract the port identifiers of the ports identified as structurally induced handshake anomalies from the physical port records; then create an anomaly record entry for each identified port identifier, and write the corresponding target network device identifier, physical port identifier, and anomaly status information into the anomaly record entry, so that the anomaly record entry corresponds one-to-one with the corresponding physical port; add an anomaly flag field to the anomaly record entry, and write the content of the anomaly flag field as a structurally induced handshake anomaly port.

[0079] Send the anomaly marker to the cloud platform; A cloud platform refers to a collection of computing resources located outside of network devices but connected to the target network devices via a network. It is used to receive data uploaded from the target network devices and to process and record it centrally.

[0080] Read all configured exception records and extract the target network device identifier, physical port identifier, and exception flag from each record. Then, organize the extracted data into records to be sent according to the order in which the exception records were generated, ensuring that each record contains the corresponding target network device identifier, physical port identifier, and exception flag. Next, establish a data transmission connection between the target network device and the cloud platform, and send each record to be sent to the cloud platform sequentially. When sending each record, write the entire record into the data stream so that the cloud platform can receive the target network device information and physical port information corresponding to the exception flag.

[0081] In the cloud platform, structural detection records are generated based on anomaly markers; The system reads all anomaly records sent from the target network device to the cloud platform and extracts the target network device identifier, physical port identifier, and anomaly marker from each record. Then, it categorizes the anomaly records according to the target network device identifier, grouping those belonging to the same target network device into a single device record set. Next, it creates a corresponding structure detection record for each anomaly record, writing the target network device identifier, physical port identifier, anomaly marker, and record generation time information into it, thus ensuring a correspondence between the structure detection record and the corresponding anomaly record. After establishing the structure detection record, it sorts all structure detection record records under the same target network device according to their physical port identifiers, forming a structure detection record set corresponding to that target network device.

[0082] Based on the structural inspection records, the target network device is inspected.

[0083] The system reads the set of structural inspection records generated in the cloud platform and extracts the target network device identifier and physical port identifier corresponding to each record. Then, it locates the target network device based on the target network device identifier and the physical port within that target network device based on the physical port identifier. Next, it inspects the interface area corresponding to the physical port according to the structural inspection record, including at least the contact between the front panel and the metal cage, the compression of the electromagnetic shielding pad, and the grounding connection status associated with the physical port. After completing the inspection of one physical port, the inspection result is written to the corresponding inspection result item in the structural inspection record. The same location, inspection, and recording operations are then performed on the target network device and physical port corresponding to the next structural inspection record. This process continues until all structural inspection records have been inspected, at which point all inspection result items are summarized and saved, thus completing the process of inspecting the target network device based on the structural inspection records.

[0084] To address the aforementioned problems, this invention also provides a cloud-based network security situation awareness and detection method, see [link to relevant documentation]. Figure 1 Specifically, including: The C-shaped grounding ring structure is determined based on the physical ports of the target network device, and a structure mapping table is constructed based on the structural design data of the target network device. Based on the structure mapping table, the encrypted handshake records of the target network device are divided into channels, and the loop gap side channel and the closed loop side channel are defined. Determine the handshake success rate of the annular gap side channel and the handshake success rate of the closed loop side channel. The wander difference of discrete grounding segments is determined based on the handshake success ratio on the annular gap side and the handshake success ratio on the closed loop side, and the physical port is judged for structural anomalies to obtain the structural induced handshake anomaly port. The target network device is detected based on the structure detection record corresponding to the structure-induced handshake anomaly port.

[0085] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cloud-based network security situation awareness and detection system, characterized in that, include: The mapping module determines the C-shaped grounding ring structure based on the physical port of the target network device, and constructs a structure mapping table based on the structural design data of the target network device. The module is divided into channels based on the structure mapping table, and the encrypted handshake records of the target network device are divided into channels, and the loop gap side channel and the closed loop side channel are defined. The statistics module determines the handshake success rate of the annular gap side channel and the handshake success rate of the closed loop side channel. The judgment module determines the wander difference of the discrete grounding segment based on the handshake success ratio on the annular gap side and the handshake success ratio on the closed loop side, and performs structural anomaly judgment on the physical port to obtain the structural induced handshake anomaly port. The detection module detects the target network device based on the structure detection records corresponding to the structure-induced handshake anomaly port.

2. The cloud-based network security situation awareness and detection system according to claim 1, characterized in that, The C-shaped grounding ring structure is determined, including: Determine the physical port of the target network device; Configure the port identifier and channel identifier of the physical port; The grounding structure formed by the front panel, metal cage, and electromagnetic shielding pad of the target network device is defined as a C-shaped grounding ring structure.

3. The cloud-based network security situation awareness and detection system according to claim 1, characterized in that, Construct a structure mapping table, including: Obtain the structural design data of the target network device; the structural design data includes the routing positions of physical differential lines on the printed circuit board; The gap formed by the lack of pressing on one side of the C-shaped grounding ring structure is defined as an open gap; Based on the structural design data, the positional relationship of the physical differential line corresponding to each channel identifier relative to the C-shaped grounding ring gap structure is determined; the positional relationship includes the side closer to the gap and the side farther from the gap. Record the positional relationship of the side closest to the opening as the structural mark of the circumferential seam side; Record the positional relationship on the side furthest from the seam as the closed-loop side structural marker; A structural mapping table is constructed based on the structural markers on the circumferential seam side and the closed-loop side.

4. The cloud-based network security situation awareness and detection system according to claim 1, characterized in that, Define the annular suture side channel and the closed-loop side channel, including: Collect encrypted handshake records from the target network device; Based on the port identifier and channel identifier in the encrypted handshake record, the corresponding structure tag is searched in the structure mapping table and used as the structure label of the encrypted handshake record; Store the encrypted handshake record with the structural label as the annular seam side structure mark into the first buffer queue; Store the encrypted handshake record with the structure label of the closed-loop side structure into the second buffer queue; Define the first buffer queue as the annular seam side channel; Define the second buffer queue as a closed-loop side channel.

5. The cloud-based network security situation awareness and detection system according to claim 1, characterized in that, Determine the handshake success rate on the annular side and the handshake success rate on the closed-loop side, including: Count the total number of ring-seam handshake sessions identified for each port in the ring-seam side channel; Count the number of successful handshake sessions on the ring-seam side in the ring-seam side channel for each port identifier; Count the total number of closed-loop handshake sessions for each port identifier in the closed-loop channel; Count the number of successful closed-loop handshake sessions for each port in the closed-loop channel; The success rate of the ring-seam handshake is determined based on the number of successful handshake sessions on the ring-seam side and the total number of handshake sessions on the ring-seam side; the success rate of the closed-loop handshake is determined based on the number of successful handshake sessions on the closed-loop side and the total number of handshake sessions on the closed-loop side.

6. The cloud-based network security situation awareness and detection system according to claim 1, characterized in that, Determining the wander difference of discrete grounding segments includes: The average handshake success rate is determined based on the handshake success rate on the annular side and the handshake success rate on the closed-loop side. Based on the average handshake success rate, the handshake success rate on the annular seam side is corrected for wandering to obtain the handshake success rate on the wandering disturbed side. Based on the average handshake success rate, a shift correction is performed on the handshake success rate on the closed-loop side to obtain the handshake success rate on the shift-maintain side. The migration difference of discrete grounding segments is determined based on the handshake success ratio of the disturbed side and the handshake success ratio of the maintained side.

7. The cloud-based network security situation awareness and detection system according to claim 2, characterized in that, The structure-induced handshake anomaly port was obtained, including: Based on the multiple discrete grounding segments in the C-shaped grounding ring structure, determine the circumferential discrete grounding segments of the ring; Obtain the site information of the circumferential discrete grounding section of the annular joint; Obtain the number of the first discrete grounding segments from the site information; Obtain the number of second discrete grounding segments from the site information; When the wander difference of discrete ground segments is positive and the number of second discrete ground segments is greater than the number of first discrete ground segments, the physical port is identified as a structure-induced handshake abnormal port.

8. The cloud-based network security situation awareness and detection system according to claim 1, characterized in that, The target network device is tested, including: Set an exception flag for the structure-induced handshake exception port; Send the anomaly marker to the cloud platform; In the cloud platform, structural detection records are generated based on anomaly markers; Based on the structural inspection records, the target network device is inspected.

9. A cloud-based method for network security situation awareness and detection, characterized in that, The method includes: The C-shaped grounding ring structure is determined based on the physical ports of the target network device, and a structure mapping table is constructed based on the structural design data of the target network device. Based on the structure mapping table, the encrypted handshake records of the target network device are divided into channels, and the loop gap side channel and the closed loop side channel are defined. Determine the handshake success rate of the annular gap side channel and the handshake success rate of the closed loop side channel. The wander difference of discrete grounding segments is determined based on the handshake success ratio on the annular gap side and the handshake success ratio on the closed loop side, and the physical port is judged for structural anomalies to obtain the structural induced handshake anomaly port. The target network device is detected based on the structure detection record corresponding to the structure-induced handshake anomaly port.

Images