Airport private network communication quality intelligent quality inspection and network intrusion security protection method

Abstract

The application relates to the technical field of network communication, in particular to an airport private network communication quality intelligent quality inspection and network intrusion security protection method, which comprises the following steps: obtaining link quality indexes, traffic records, access logs, device states and security alarms generated by network devices and service servers, binding the same into a quality inspection and security joint event according to time windows, link paths, device identifiers, address ports, protocol types and service system identifiers, generating link quality states and access abnormal states, forming a quality inspection and security joint risk value when meeting the association conditions, outputting a treatment instruction according to a service link level, a link redundancy state and a link quality state, and correcting a risk judgment condition or a treatment level according to a link quality change, an alarm change and a service access state after treatment. The application forms a closed loop of quality inspection judgment, security detection and treatment under the same communication event through joint event construction and feedback correction.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a method for intelligent quality inspection of airport private network communication and network intrusion security protection. Background Technology

[0002] In the field of network communication technology, tasks typically revolve around message transmission, link status collection, performance recording, access control, and log storage for terminals, switching equipment, gateways, servers, and security devices within dedicated networks. Network operational status is assessed based on IP addresses, ports, protocol types, latency, packet loss rate, alarm records, and session sequences. Configuration, blocking, or logging operations are executed through command interaction between the management platform and boundary devices. Specifically, the traditional intelligent quality inspection and network intrusion security protection method for airport dedicated network communication links (such as those for airport production, security, flight information display, and operational support) collects traffic records, device logs, link indicators, access requests, and abnormal alarms generated by switches, wireless access points, firewalls, intrusion detection devices, and service servers. Communication quality status and intrusion behavior characteristics are compared according to preset thresholds, protocol fields, source and destination addresses, port mapping, session frequency, and rule base matching relationships. The judgment results are written to the operation and maintenance platform or sent to security devices for alarm, isolation, blocking, and audit recording.

[0003] Traditional airport private network communication quality inspection and intrusion detection rely on link indicators, access logs, device alarms, and rule matching to output quality status or security alarms respectively. The data sources lack correlation objects formed by time windows, link paths, device identifiers, and business system identifiers. It is difficult to correspond quality fluctuations, access anomalies, and device status in the same communication event. The constraint relationship between the handling action and the business link level and link redundancy status is not clear enough. It is difficult to use the quality changes and alarm changes after the handling in subsequent judgments. Audit records are difficult to reflect the differences in status before and after the handling. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent quality inspection and network intrusion security protection method for airport private networks. During the operation of the airport private network, communication quality inspection data, network access data, device status data, and security alarm data are associated with the same communication event to form a joint judgment between communication quality status and access anomaly status. Furthermore, the method combines business link level, link redundancy status, and post-handling feedback data to constrain security handling and subsequent judgments. This method is applicable to the collaborative processing of communication quality inspection and network intrusion security protection in airport private networks.

[0005] To achieve the purpose of the invention, the present invention adopts the following technical solution: an intelligent quality inspection method for airport private network communication quality and a network intrusion security protection method, comprising the following steps: The system acquires link quality metrics, traffic records, access logs, device status, and security alarms generated by switches, wireless access points, firewalls, intrusion detection devices, and service servers within the airport private network, and obtains the corresponding service link level and link redundancy status. It then binds the link quality metrics, traffic records, access logs, device status, and security alarms into a joint quality inspection and security event based on time windows, link paths, device identifiers, source and destination addresses, ports, protocol types, and service system identifiers. Finally, it generates a link quality status based on latency, packet loss rate, jitter, connection interruption counts, and port load within the joint quality inspection and security event, and generates access anomalies based on access frequency, port access sequence, protocol fields, session duration, and rule base hit records within the joint quality inspection and security event. Status; When the link quality status and the access anomaly status meet the spatiotemporal and business identifier overlap conditions within the same time window, the same link path, or the same business system identifier, a risk association level is generated based on the overlap degree, and the risk association level is corrected in conjunction with the device status, thereby generating a joint risk value for quality inspection and security. When the association conditions are not met, a single-domain quality inspection result or a single-domain security detection result is generated. Based on the joint risk value for quality inspection and security, the business link level, the link redundancy status, and the current link quality status, alarms, traffic mirroring, rate limiting, isolation, blocking, or audit instructions are output, and changes in link quality, alarms, and business access status after the instructions are executed are collected. The risk judgment conditions or handling levels of subsequent similar joint events for quality inspection and security are dynamically corrected based on the collected results.

[0006] Furthermore, when acquiring multi-source operational data from the airport private network, the system reads port load, connection interruption records, and link reachability status from the switch; terminal access records and connection persistence records from the wireless access point; access control logs from the firewall; rule base hit records and security alarms from the intrusion detection device; and access logs from the service server. The system then performs source tagging on the link quality indicators, traffic records, access logs, device status, and security alarms according to the collection time. Finally, it performs source tagging on the link quality indicators, traffic records, access logs, device status, and security alarms. All alarms undergo data collection time calibration. When the collection times of data from different sources fall within the same time window, the data from different sources are written into the same data group to be associated. Field integrity verification is performed on the data from different sources in the data group to be associated. When source and destination addresses, ports, protocol types, device identifiers, or business system identifiers are missing, the data from different sources that have been marked with source information are retained and records to be completed are output. Continuous fields in the records to be completed are completed based on historical sliding window data, and discrete fields are completed or removed through association matching. When the field integrity verification is passed or the completion is completed, the process enters the quality inspection and security joint event binding process.

[0007] Furthermore, when binding a data group to be associated as a joint quality inspection and security event, the link path, device identifier, source and destination address, port, protocol type, and business system identifier in the data group to be associated are extracted. Records with the same business system identifier and continuous link paths are identified as the same candidate event group. The device identifier, source and destination address, port, and protocol type in the candidate event group are verified for consistency. When the consistency verification passes, the candidate event group is written into the joint quality inspection and security event. When the consistency verification fails, the candidate event group is split into link-side candidate events, access-side candidate events, and alarm-side candidate events. The joint quality inspection and security event is bound to the source tag, and the source correspondence between link quality indicators, traffic records, access logs, device status, and security alarms is retained in the joint quality inspection and security event.

[0008] Furthermore, the binding result of the joint quality inspection and security event includes the temporal correspondence between link-side records, access-side records, and alarm-side records. When the link-side records, access-side records, and alarm-side records correspond to the same business system identifier within the same time window, the link path in the link-side record is taken as the main event path, and the source and destination addresses and ports in the access-side records are written into the access attributes of the main event path. When the link-side records, access-side records, and alarm-side records do not correspond to the same business system identifier, the source marker of each record is retained, and each record is written into the event set to be reviewed.

[0009] Furthermore, when generating the link quality status, latency, packet loss rate, jitter, number of connection interruptions, port load, and link reachability are extracted from the joint quality inspection and security events. The extraction results are then categorized into a link status set according to the link path and device identifier. The latency, packet loss rate, jitter, number of connection interruptions, port load, and link reachability in the link status set are sorted according to the collection time. Quality changes that occur consecutively under the same link path and exceed a preset attenuation threshold are recorded as a link quality change sequence. When there is a time correspondence between the link quality change sequence and a connection interruption record or a link unreachable record, the link quality status is marked as an abnormal link status. When there is no time correspondence, the link quality status is marked as a link observation status.

[0010] Furthermore, when generating an access anomaly state, access frequency, port access sequence, protocol fields, session duration, and rule base hit records are extracted from the quality inspection and security joint event. The extraction results are then categorized into an access state set according to the source and destination addresses and the business system identifier. The port access sequence and protocol fields in the access state set are compared sequentially, and the access frequency, session duration, and rule base hit records are written into the same access behavior record. When the port access sequence in the access behavior record deviates from the preset access baseline corresponding to the business system identifier, if a rule base hit record exists, the access anomaly state is marked as a security anomaly state; if no rule base hit record exists, the access anomaly state is marked as an access observation state. When the port access sequence does not deviate from the preset access baseline corresponding to the business system identifier, the access anomaly state is marked as an access observation state.

[0011] Furthermore, the process of generating the risk association level includes: mapping the link quality status and the access anomaly status according to time window, link path, and business system identifier to form a status association record; when the status association record contains both link anomaly status and security anomaly status, and the link anomaly status and the security anomaly status correspond to the same link path or the same business system identifier, the status association record is determined as a joint risk record; when the status association record contains only link anomaly status or only security anomaly status, the generation of quality inspection and security joint risk value is stopped, the status association record is determined as a single-domain detection record, and a single-domain quality inspection result or a single-domain security detection result is output based on the single-domain detection record.

[0012] Furthermore, when correcting the risk association level, the link anomaly status, security anomaly status, device status, and business system identifier are extracted from the joint risk record; the initial risk association level is determined based on the time overlap, link path overlap, and business system identifier overlap between the link anomaly status and security anomaly status; the device status correction weight is determined based on whether the device status corresponds to a connection interruption record, a link unreachable record, or a rule base hit record; the initial risk association level is corrected using the device status correction weight, and the corrected risk association level is used as the joint risk value for quality inspection and security.

[0013] Furthermore, when outputting alarm, traffic mirroring, rate limiting, isolation, blocking, or audit instructions, the quality inspection and security joint risk value is mapped to the business link level, the link redundancy status, and the current link quality status to form a handling condition group. When the handling condition group corresponds to a critical business link and the link redundancy status is no redundant link, the handling instructions are output in the priority order of alarm, traffic mirroring, and rate limiting. When the handling condition group corresponds to a non-critical business link, or when the handling condition group corresponds to a critical business link and the link redundancy status is redundant link, the handling instructions are output in the priority order of isolation, blocking, and audit recording.

[0014] Furthermore, when revising the risk assessment conditions or handling levels of subsequent similar joint quality inspection and security incidents, the link quality changes, alarm changes, and service access status after the execution of the handling instruction are collected, and the collected results are correlated with the link quality status, access anomaly status, and joint quality inspection and security risk value before the execution of the handling instruction. When the collected results show that the link quality changes and alarm changes correspond to the same business system identifier, the collected results are written into the feedback correction record. When subsequent joint quality inspection and security incidents correspond to the same business system identifier, link path, or source and destination address as the feedback correction record, the judgment threshold of the association conditions is dynamically adjusted according to the feedback correction record, or the handling level of subsequent joint quality inspection and security incidents is changed.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, link quality indicators, traffic records, access logs, device status, and security alarms generated by switches, wireless access points, firewalls, intrusion detection devices, and service servers are bound into a joint quality inspection and security event. This allows for a comparison between communication quality status and abnormal access status within the same time window, link path, or service system identifier. Based on the joint quality inspection and security risk value, service link level, link redundancy status, and current link quality status, processing instructions are output, ensuring that alarms, traffic mirroring, rate limiting, isolation, blocking, or audit records correspond to the service link status. After processing, changes in link quality, alarms, and service access status are reused for subsequent risk assessment conditions or processing level corrections, creating a closed loop between quality inspection judgment and security protection. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1This is the main flowchart of the intelligent quality inspection and network intrusion security protection method for airport private network communication of the present invention; Figure 2 This invention provides a flowchart for obtaining multi-source operational data from an airport private network. Figure 3 This invention is bound to a joint event logic diagram for quality inspection and safety; Figure 4 This invention provides a flowchart for generating link quality status and generating access anomaly status. Figure 5 A risk association level and correction logic diagram is generated for this invention; Figure 6 This is a closed-loop diagram of the output processing instructions and feedback corrections of the present invention. Detailed Implementation

[0018] The following description, in conjunction with the scope of protection text and the invention content, illustrates the technical solutions described in this invention. For ease of understanding, the link quality indicators used in subsequent embodiments refer to data such as latency, packet loss rate, jitter, connection interruption count, port load, and link reachability status generated from the operation records of switches, wireless access points, and corresponding links in the airport private network; traffic records refer to communication records related to source and destination addresses, ports, protocol types, session duration, and access frequency during transmission in the airport private network; access logs refer to records generated by firewalls and business servers during access control, business access, and session establishment; device status refers to the operating status of switches, wireless access points, firewalls, intrusion detection devices, and business servers during communication; security alarms refer to alarm content generated by intrusion detection devices based on rule-based record hits. The following embodiments do not change the technical meaning of the above terms. Figures 1 to 6 This is used to illustrate the process, data flow, state relationships, and feedback loop of this embodiment.

[0019] Please see Figures 1 to 6This embodiment provides an intelligent quality inspection and network intrusion security protection method for airport private network communication quality, used to jointly process communication quality status and network intrusion risks in the airport private network. The airport private network includes network links carrying communication for flight information display, security, operational support, and production services. These network links contain switches, wireless access points, firewalls, intrusion detection devices, and service servers. Each network device continuously generates link quality indicators, traffic records, access logs, device status, and security alarms during operation. The operation and maintenance or security side's processing program reads the corresponding data from the aforementioned devices and establishes a correspondence between the data according to the same time window, the same link path, and the same business system identifier. This allows communication quality data and security detection data scattered across different devices to be included in the same quality inspection and security joint event. Based on link quality status, access anomaly status, risk association level, business link level, and link redundancy status, corresponding handling instructions are output. The changes in link quality, alarms, and business access status after handling are written back to the judgment process of subsequent similar events.

[0020] S1 acquires link quality metrics, traffic records, access logs, device status, and security alarms generated by switches, wireless access points, firewalls, intrusion detection devices, and service servers in the airport private network, and obtains the service link level and link redundancy status of the corresponding links. Switches provide port load, connection interruption records, and link reachability status. Port load characterizes the communication carrying status of the corresponding port during the acquisition time, connection interruption records characterize the occurrence time and corresponding port of the link connection interruption, and link reachability status characterizes whether the link path can complete communication connectivity. Wireless access points provide terminal access records and connection persistence records. Terminal access records characterize the connection relationship between the access terminal and the wireless access point, and connection persistence records characterize the persistence status of the wireless connection within a time window. Firewalls provide access control logs, which record source and destination addresses, ports, protocol types, and access handling actions. Intrusion detection devices provide rule base hit records and security alarms. Rule base hit records reflect the matching results between access behavior and configured intrusion detection rules, and security alarms reflect the alarm status triggered by the corresponding access behavior. Service servers provide access logs, which record the access subject, access time, access object, service system identifier, and session duration.

[0021] S11, when acquiring multi-source operational data from the airport private network, reads port load, connection interruption records, and link reachability status from switches; reads terminal access records and connection persistence records from wireless access points; reads access control logs from firewalls; reads rule base hit records and security alarms from intrusion detection devices; and reads access logs from business servers. It then marks the source of link quality indicators, traffic records, access logs, device status, and security alarms according to the collection time. The source mark includes at least the generating device name, collection time, data category, device identifier, and business system identifier, enabling subsequent processing to identify the generating entity and the business link to which each data item belongs. For data from different devices within the same collection time, the processing program does not directly merge them into the same event; instead, it first retains the source mark of each data item, allowing link-side data, access-side data, and alarm-side data to be traced in subsequent calibration.

[0022] S12 performs time calibration on the collection of link quality indicators, traffic records, access logs, device status, and security alarms that have completed source tagging. Time calibration addresses discrepancies in recording times between different devices. The processing procedure uses the unified time window of the airport private network as a benchmark, converting the collection time of data from each source to the same time position within that window. When the collection times of data from different sources fall within the same time window, the data from different sources are written into the same data group to be associated; when the collection times of data from different sources do not fall within the same time window, the data from different sources are retained in the data groups corresponding to their respective time windows. Through this processing, the data in the data groups to be associated have a comparable basis in the time dimension, avoiding misclassifying link quality changes and security alarms occurring in different time periods into the same communication event.

[0023] S13: Perform field integrity verification on data from different sources in the data group to be associated. Field integrity verification uses source and destination addresses, ports, protocol types, device identifiers, and business system identifiers as verification objects. Source and destination addresses are used to determine the access subject and access target; ports are used to determine the business access entry point; protocol types are used to determine the communication protocol category; device identifiers are used to determine the data generating device; and business system identifiers are used to determine the business link to which the communication event belongs. When discrete fields such as source and destination addresses, ports, protocol types, device identifiers, and business system identifiers, or continuous fields such as latency, packet loss rate, and jitter are missing, the processing program retains the different source data with completed source markings and outputs records to be completed. Records to be completed are used to identify missing fields, data sources, and collection times. Continuous fields in the records to be completed are completed based on historical sliding window data. Continuous fields include records of latency, packet loss rate, jitter, port load, and session duration that change over time. Discrete fields are performed through association matching for completion or removal. Discrete fields include source and destination addresses, ports, protocol types, device identifiers, and business system identifiers. Association matching for completion is based on fields that have been fully recorded under the same collection time, same link path, same device identifier, or same business system identifier. When a unique completion result cannot be formed through association matching, the data corresponding to the missing fields is removed, and the removed data is not written to subsequent quality inspection and security joint events. When the field integrity verification passes or the completion is completed, the processing procedure enters the quality inspection and security joint event binding process.

[0024] S2 binds link quality indicators, traffic records, access logs, device status, and security alarms into a joint quality inspection and security event based on time window, link path, device identifier, source and destination addresses, port, protocol type, and business system identifier. This joint event carries link-side records, access-side records, and alarm-side records under the same airport private network communication event. The link path indicates the network path traversed by the communication; the device identifier indicates the device participating in the communication or generating records along the path; the source and destination addresses and ports indicate the access relationship; the protocol type indicates the communication protocol; and the business system identifier indicates the corresponding business link. After binding these fields, the processing program can read changes in communication quality, changes in access behavior, device operating status, and security alarm status within the same event object.

[0025] S21, when binding a data group to be associated as a joint quality inspection and security event, extract the link path, device identifier, source and destination addresses, port, protocol type, and business system identifier from the data group. Records with the same business system identifier and continuous link paths are identified as the same candidate event group. Continuous link paths mean that there is a traceable communication relationship between the network devices or communication paths corresponding to adjacent records, and communication records under the same business system identifier can form an access chain based on source address, destination address, port, and protocol type. The candidate event group serves as an intermediate state before binding, used to receive data that has completed time calibration and field verification.

[0026] S22 performs consistency verification on the device identifier, source and destination addresses, ports, and protocol types in the candidate event group. When the consistency verification passes, the candidate event group is written into the quality inspection and security joint event. When the consistency verification fails, the candidate event group is split into link-side candidate events, access-side candidate events, and alarm-side candidate events. Link-side candidate events are used to retain link quality indicators and device status; access-side candidate events are used to retain traffic records and access logs; and alarm-side candidate events are used to retain rule base hit records and security alarms. The split candidate events do not directly enter the joint risk calculation but retain their source markers and time window positions for subsequent use by the event set to be reviewed. This process ensures that data that cannot form a consistent correspondence does not enter the same risk judgment chain.

[0027] S23, bind the joint quality inspection and security event with the source tag, and retain the source correspondence between link quality indicators, traffic records, access logs, device status, and security alarms in the joint quality inspection and security event. The source correspondence is used to indicate the generating device, collection time, and data category of each data item in the same joint quality inspection and security event. The binding result of the joint quality inspection and security event includes the time sequence correspondence between link-side records, access-side records, and alarm-side records. When the link-side records, access-side records, and alarm-side records correspond to the same business system identifier within the same time window, the link path in the link-side record is used as the main event path, and the source and destination addresses and ports in the access-side records are written into the access attributes of the main event path. When the link-side records, access-side records, and alarm-side records do not correspond to the same business system identifier, the source tag of each record is retained, and each record is written into the event set to be reviewed. The event set to be reviewed is used to store data that has not yet formed a joint event, and will participate in binding again after subsequent field completion or time window recalibration.

[0028] S3 generates a link quality status based on latency, packet loss rate, jitter, connection interruption count, and port load from the joint quality inspection and security events. It also generates an access anomaly status based on access frequency, port access sequence, protocol fields, session duration, and rule base hit records from the same joint events. Link quality status and access anomaly status are intermediate states for subsequent correlation judgments; they are not directly formed from a single raw data source but are generated based on link-side records and access-side records, respectively. Link quality status indicates changes in communication quality within the same link path, while access anomaly status indicates the relationship between access behavior under the same source and destination addresses and business system identifiers and the preset access baseline and rule base hit records.

[0029] S31, when generating link quality status, latency, packet loss rate, jitter, connection interruption count, port load, and link reachability are extracted from the joint quality inspection and security events. The extracted results are then categorized into a link status set according to the link path and device identifier. The link status set uses the link path as the primary index and the device identifier as the secondary index to store quality change records generated by different devices on the same link path. The latency, packet loss rate, jitter, connection interruption count, port load, and link reachability in the link status set are sorted according to the collection time. Quality changes that occur consecutively on the same link path and exceed a preset attenuation threshold are recorded as a link quality change sequence. The preset attenuation threshold is used to distinguish between normal fluctuations in link quality status and quality changes that require anomaly detection. The link quality change sequence records the direction and duration of quality changes on the same link path within adjacent collection times.

[0030] S32, when a time correspondence exists between the link quality change sequence and a connection interruption record or link unreachable record, the link quality status is marked as an abnormal link state; when no time correspondence exists, the link quality status is marked as a link observation state. The time correspondence refers to the time when the quality change in the link quality change sequence occurs falling within the same time window as the time when the connection interruption record or link unreachable record occurs. The abnormal link state enters the subsequent joint risk value generation process for quality inspection and security, while the link observation state is used to form single-domain quality inspection results or as the basis for continuous observation of quality changes within subsequent time windows.

[0031] S33, when generating an access anomaly state, extract access frequency, port access sequence, protocol field, session duration, and rule base hit records from the joint quality inspection and security event. The extracted results are then categorized into an access state set based on source and destination addresses and business system identifiers. The access state set uses the source and destination addresses as the access subject index and the business system identifier as the business object index, and is used to store changes in access behavior of the same access subject within the same business system. The port access sequence and protocol field in the access state set are compared sequentially, and the access frequency, session duration, and rule base hit records are written into the same access behavior record. The port access sequence indicates the order in which the access subject accesses ports within a time window; the protocol field indicates the protocol content used in the access request; the access frequency characterizes the statistical frequency of connection requests initiated by the same access subject within a unit time window; the session duration records the complete time span from establishment to release of a single business communication; and the rule base hit records indicate the matching status of access behavior with intrusion detection rules.

[0032] S34, when the port access sequence in the access behavior record deviates from the preset access baseline corresponding to the business system identifier, if a rule base match record exists, the access anomaly state is marked as a security anomaly state; if no rule base match record exists, the access anomaly state is marked as an access observation state. When the port access sequence does not deviate from the preset access baseline corresponding to the business system identifier, the access anomaly state is marked as an access observation state. The preset access baseline is used to represent the port access order of the business link corresponding to the business system identifier during normal access. The security anomaly state enters the subsequent risk association level generation process, and the access observation state is used to form a single-domain security detection result or as the basis for observing access behavior within a subsequent time window.

[0033] S4: When the link quality status and access anomaly status meet the association condition of spatiotemporal and business identifier overlap within the same time window, the same link path, or the same business system identifier, a risk association level is generated based on the overlap degree. This risk association level is then corrected in conjunction with the device status to generate a joint quality inspection and security risk value. When the association condition is not met, a single-domain quality inspection result or a single-domain security detection result is generated. This step converts parallel detection of the link quality status and access anomaly status into joint judgment. The association conditions include time window overlap, link path overlap, and business system identifier overlap. The overlap degree indicates the degree of correspondence between the link quality status and the access anomaly status under these conditions.

[0034] S41, the risk association level generation process includes: mapping link quality status and access anomaly status according to time window, link path, and business system identifier to form a status association record. The status association record stores the link quality status, access anomaly status, corresponding time window, link path, and business system identifier. If a status association record contains both link anomaly status and security anomaly status, and the link anomaly status and security anomaly status correspond to the same link path or the same business system identifier, the status association record is identified as a joint risk record. The joint risk record is used to enter the risk association level generation and correction process. If a status association record only contains link anomaly status or only contains security anomaly status, the generation of quality inspection and security joint risk values ​​is stopped, the status association record is identified as a single-domain detection record, and a single-domain quality inspection result or single-domain security detection result is output based on the single-domain detection record.

[0035] S42, when correcting the risk association level, extract the link anomaly status, security anomaly status, device status, and business system identifier from the joint risk record; determine the initial risk association level based on the time overlap, link path overlap, and business system identifier overlap between the link anomaly status and security anomaly status. The time overlap reflects whether the link anomaly status and security anomaly status fall within the same time window; the link path overlap reflects whether the two types of statuses correspond to the same main event path; and the business system identifier overlap reflects whether the two types of statuses correspond to the same business system. The processing procedure forms the initial risk association level according to the number and order of matches in the time overlap, link path overlap, and business system identifier overlap. The initial risk association level is not the final output but is further corrected in conjunction with the device status.

[0036] S43. Determine the device status correction weight based on whether the device status corresponds to a connection interruption record, a link unreachable record, or a rule base hit record. Connection interruption records and link unreachable records indicate whether there are operational anomalies on the link-side device, while rule base hit records indicate whether the access-side behavior triggers security rules. When the device status corresponds to a connection interruption record or a link unreachable record, the device status correction weight increases the impact of the link anomaly status in the joint risk assessment; when the device status corresponds to a rule base hit record, the device status correction weight increases the impact of the security anomaly status in the joint risk assessment; when the device status does not correspond to a connection interruption record, link unreachable record, or rule base hit record, the device status correction weight remains unchanged, without altering the initial risk association level. The initial risk association level is corrected using the device status correction weight, and the corrected risk association level is used as the joint risk value for quality inspection and security. The joint risk value for quality inspection and security serves as the basis for subsequent handling instruction output.

[0037] S5 outputs alarms, traffic mirroring, rate limiting, isolation, blocking, or audit commands based on the joint quality inspection and security risk value, business link level, link redundancy status, and current link quality status. It also collects changes in link quality, alarms, and business access status after command execution, dynamically adjusting the risk assessment conditions or handling levels for subsequent similar joint quality inspection and security events based on the collected results. The business link level distinguishes between critical and non-critical business links; the link redundancy status distinguishes between links without redundancy and those with redundancy; and the current link quality status indicates whether the link was in an abnormal or observation state before the handling action was executed. Handling commands are not determined solely by the joint quality inspection and security risk value, but are jointly determined by the joint quality inspection and security risk value, business link level, link redundancy status, and current link quality status.

[0038] When outputting alarm, traffic mirroring, rate limiting, isolation, blocking, or audit commands (S51), the joint risk value of quality inspection and security is mapped to the business link level, link redundancy status, and current link quality status to form a handling condition group. The handling condition group is used to store the correspondence between risk assessment results and link business attributes. When the handling condition group corresponds to a critical business link and the link redundancy status is "no redundant link," handling commands are output in the order of alarm, traffic mirroring, and rate limiting. Alarms are used to alert the operations or security side to the joint quality inspection and security event; traffic mirroring is used to copy the corresponding traffic to the detection side for observation; and rate limiting is used to restrict the corresponding access behavior or the transmission rate on the corresponding link. When the handling condition group corresponds to a non-critical business link, or when the handling condition group corresponds to a critical business link and the link redundancy status is "redundant link exists," handling commands are output in the order of isolation, blocking, and audit logging. Isolation is used to separate the corresponding session or access subject from the business link; blocking is used to terminate the corresponding access behavior; and audit logging is used to store the handling action, handling time, handling object, and handling basis.

[0039] S52, the handling instructions are output to the corresponding execution objects. Alarm instructions are output to the operation and maintenance platform or security management interface; traffic mirroring instructions are output to the mirroring configuration object of the switch or firewall; rate limiting instructions are output to the access control object of the switch, firewall, or wireless access point; isolation instructions are output to the session processing object of the firewall, switch, or wireless access point; blocking instructions are output to the linkage object of the firewall or intrusion detection device; and auditing instructions are output to the audit log storage object. After receiving the handling instructions, the execution object returns an execution status. The execution status includes received, executed, execution failed, or pending confirmation. The processing program writes the execution status to the corresponding quality inspection and security joint event, ensuring that the handling action corresponds to the event object.

[0040] S53, when revising the risk assessment conditions or handling level of subsequent similar joint quality inspection and security incidents, collect the changes in link quality, alarm changes, and service access status after the execution of the handling instruction, and correlate the collected results with the link quality status, access anomaly status, and joint quality inspection and security risk value before the execution of the handling instruction. Link quality changes indicate changes in latency, packet loss rate, jitter, connection interruption count, and port load after handling; alarm changes indicate whether security alarms continue to occur after handling; and service access status indicates whether the service server continues to receive corresponding service access. The correspondence before and after handling is used to form a feedback correction record. When the collected results show that the link quality change and alarm change correspond to the same business system identifier, the collected results are written into the feedback correction record. The feedback correction record includes at least the business system identifier, link path, source and destination addresses, handling instruction, link quality status before handling, access anomaly status before handling, joint quality inspection and security risk value before handling, link quality change after handling, alarm change after handling, and service access status after handling.

[0041] S54. When subsequent joint quality inspection and security events correspond to the same business system identifier, link path, or source / destination address as the feedback correction record, the judgment threshold of the association conditions is dynamically adjusted based on the feedback correction record, or the handling level of the subsequent joint quality inspection and security events is changed. Dynamic adjustment does not change the binding rules of the joint quality inspection and security events, but rather affects the judgment of association conditions and the determination of handling levels for subsequent similar events. If the feedback correction record shows that the link quality change and alarm change after handling still correspond to the same business system identifier, the corresponding handling level for subsequent similar events can be increased; if the feedback correction record shows that alarm changes decrease and business access status recovers after handling, the handling level for subsequent similar events can be maintained or decreased. The adjusted risk judgment conditions or handling level are used to judge similar joint quality inspection and security events in the next time window, forming a closed-loop processing chain from data acquisition, event binding, status generation, risk correction, instruction output to feedback correction.

[0042] Through the above implementation method, link quality indicators, traffic records, access logs, device status, and security alarms in the airport private network no longer participate in quality inspection or security testing solely through scattered recording. Instead, they are bound together as joint quality inspection and security events under constraints such as time window, link path, device identifier, source and destination addresses, port, protocol type, and business system identifier. Link quality status and access anomaly status serve as intermediate states in the generation of risk association levels. Device status is used to correct risk association levels, and business link level and link redundancy status are used to constrain the output of handling instructions. Changes in link quality, alarms, and business access status after handling are used to provide feedback and correct the judgment conditions and handling levels for subsequent similar events. Thus, this embodiment forms a technical closed loop that can be verified by data source, processing procedure, intermediate states, output objects, and feedback results.

[0043] The specific processes, field sources, time window calibration, candidate event group splitting, status marking, risk association level correction, disposal instruction output, and feedback correction relationships in the embodiments are used to illustrate the feasible implementation methods of the technical solutions described in this invention, and should not limit this invention to the specific embodiments listed. Without departing from the technical solutions described in this invention, any equivalent substitutions, equivalent modifications, equivalent combinations, order adjustments, equivalent transformations of field names, equivalent acceptance of the executing entity, or equivalent changes in the carrier form that can be conceived by those skilled in the art should fall within the scope of protection of this patent; however, they should not be extended to unclaimed topics, nor should the substantive correspondence of the technical objects be changed through name changes.

Claims

1. A method for intelligent quality inspection and network intrusion security protection of airport private network communication quality, characterized in that, Acquire link quality metrics, traffic records, access logs, device status, and security alarms generated by switches, wireless access points, firewalls, intrusion detection devices, and business servers in the airport private network, and obtain the corresponding business link level and link redundancy status; Based on time window, link path, device identifier, source and destination addresses, port, protocol type, and business system identifier, the link quality indicators, traffic records, access logs, device status, and security alarms are bound into a joint quality inspection and security event; The link quality status is generated based on the latency, packet loss rate, jitter, number of connection interruptions and port load in the joint quality inspection and security event. The access anomaly status is generated based on the access frequency, port access sequence, protocol fields, session duration and rule base hit records in the joint quality inspection and security event. When the link quality status and the access anomaly status meet the association condition of spatiotemporal and business identifier overlap under the same time window, the same link path, or the same business system identifier, a risk association level is generated based on the degree of overlap, and the risk association level is corrected in combination with the device status, thereby generating a joint risk value for quality inspection and security. When the association condition is not met, a single-domain quality inspection result or a single-domain security detection result is generated. Based on the joint risk value for quality inspection and security, the business link level, the link redundancy status, and the current link quality status, output alarms, traffic mirroring, rate limiting, isolation, blocking, or audit commands, and collect link quality changes, alarm changes, and business access status after command execution. Based on the collection results, dynamically adjust the risk judgment conditions or handling level for subsequent similar joint quality inspection and security events.

2. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 1, characterized in that, Obtain multi-source operational data from the airport's private network, including: The system reads port load, connection interruption records, and link reachability status from the switch; terminal access records and connection hold records from the wireless access point; access control logs from the firewall; rule base hit records and security alarms from the intrusion detection device; and access logs from the service server. It also marks the source of the link quality indicators, traffic records, access logs, device status, and security alarms according to the collection time. The collection time of the link quality indicators, traffic records, access logs, device status and security alarms that have been marked with source identification is calibrated. When the collection time of data from different sources falls into the same time window, the data from different sources are written into the same data group to be associated. The data from different sources in the data group to be associated are subjected to field integrity verification. When the source and destination addresses, ports, protocol types, device identifiers or business system identifiers are missing, the different source data with completed source markings are retained and the records to be completed are output. The continuous fields in the records to be completed are completed based on the historical sliding window data, and the discrete fields are matched and completed or removed. When the field integrity verification is passed or the completion is completed, the process enters the quality inspection and security joint event binding process.

3. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 2, characterized in that, Binding the data group to be associated as a joint quality inspection and safety event includes: Extract the link path, device identifier, source and destination address, port, protocol type and business system identifier from the data group to be associated, and identify the records with the same business system identifier and continuous link paths as the same candidate event group; The device identifier, source and destination addresses, ports and protocol types in the candidate event group are verified for consistency. When the consistency verification is successful, the candidate event group is written into the quality inspection and security joint event. When the consistency verification fails, the candidate event group is split into link-side candidate events, access-side candidate events and alarm-side candidate events. The quality inspection and security joint event is bound to the source tag, and the source correspondence between link quality indicators, traffic records, access logs, device status and security alarms is retained in the quality inspection and security joint event.

4. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 3, characterized in that, The binding result of the joint quality inspection and security event includes the time sequence correspondence between link-side records, access-side records, and alarm-side records; When the link-side record, access-side record, and alarm-side record correspond to the same business system identifier within the same time window, the link path in the link-side record is taken as the main event path, and the source and destination addresses and ports in the access-side record are written into the access attributes of the main event path. When the link-side record, access-side record, and alarm-side record do not correspond to the same business system identifier, the source marker of each record is retained, and each record is written into the event set to be reviewed.

5. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 3, characterized in that, Generate link quality status, including: The latency, packet loss rate, jitter, number of connection interruptions, port load, and link reachability status are extracted from the joint quality inspection and security events. The extraction results are then categorized into a link status set according to the link path and device identifier. The latency, packet loss rate, jitter, number of connection interruptions, port load, and link reachability in the link status set are sorted according to the collection time, and the quality changes that occur consecutively under the same link path and exceed the preset attenuation threshold are recorded as the link quality change sequence. When there is a time correspondence between the link quality change sequence and the connection interruption record or the link unreachable record, the link quality status is marked as an abnormal link status; when there is no time correspondence, the link quality status is marked as a link observation status.

6. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 3, characterized in that, Generate access exception states, including: Extract access frequency, port access sequence, protocol field, session duration and rule base hit record from the joint quality inspection and security events, and classify the extraction results into the access status set according to the source and destination addresses and business system identifiers; The port access sequence and protocol field in the access status set are compared sequentially, and the access frequency, session duration and rule base hit record are written into the same access behavior record. When the port access sequence in the access behavior record deviates from the preset access baseline corresponding to the business system identifier, if there is a rule base hit record, the access abnormal state is marked as a security abnormal state; if there is no rule base hit record, the access abnormal state is marked as an access observation state. When the port access sequence does not deviate from the preset access baseline corresponding to the business system identifier, the access abnormal state is marked as an access observation state.

7. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 1, characterized in that, The process of generating the risk association level includes: The link quality status and the access anomaly status are mapped according to time window, link path and business system identifier to form a status association record; When the status association record contains both link abnormality status and security abnormality status, and the link abnormality status and security abnormality status correspond to the same link path or the same business system identifier, the status association record is determined as a joint risk record. When the status association record contains only link abnormal status or only security abnormal status, stop generating quality inspection and security joint risk value, determine the status association record as a single-domain detection record, and output single-domain quality inspection result or single-domain security detection result based on the single-domain detection record.

8. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 7, characterized in that, Correcting the risk association level includes: extracting link anomaly status, security anomaly status, device status, and business system identifier from the joint risk record; The initial risk association level is determined based on the temporal overlap, link path overlap, and business system identifier overlap between abnormal link states and abnormal security states. Based on whether the device status corresponds to a connection interruption record, a link unreachable record, or a rule base hit record, a device status correction weight is determined. The initial risk association level is corrected using the device status correction weight, and the corrected risk association level is used as the joint risk value for quality inspection and safety.

9. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 1, characterized in that, Output alarm, traffic mirroring, rate limiting, isolation, blocking, or auditing commands, including: The joint risk value for quality inspection and security is mapped to the business link level, the link redundancy status, and the current link quality status to form a set of handling conditions; When the handling condition group corresponds to a critical business link and the link redundancy status is no redundant link, the handling instructions are output in the priority order of alarm, traffic mirroring, and rate limiting. When the disposal condition group corresponds to a non-critical business link, or when the disposal condition group corresponds to a critical business link and the link redundancy status is that a redundant link exists, disposal instructions are output in the priority order of isolation, blocking, and audit recording.

10. The intelligent quality inspection and network intrusion security protection method for airport private network communication quality according to claim 9, characterized in that, Revise the risk assessment criteria or handling levels for subsequent similar joint quality inspection and safety incidents, including: Collect the link quality changes, alarm changes, and service access status after the execution of the disposal instruction, and correlate the collected results with the link quality status, access anomaly status, and joint quality inspection and security risk value before the execution of the disposal instruction; When the collection results show that the link quality change and the alarm change correspond to the same business system identifier, the collection results will be written into the feedback correction record; When a subsequent joint quality inspection and security event corresponds to the same business system identifier, link path, or source / destination address as the feedback correction record, the judgment threshold of the association condition is dynamically adjusted based on the feedback correction record, or the handling level of the subsequent joint quality inspection and security event is changed.

Images