A network security monitoring method and system

Abstract

The present application relates to the technical field of data monitoring, and more particularly to a network security monitoring method and system, which analyzes the transmission state of a transmission data group based on channel overlap and instantaneous impact value, determines a plurality of collection points for real-time collection of the arrival time difference of each data stream in the transmission data group, analyzes the fluctuation of the arrival time difference to determine the data interference strength, and divides the synchronous arrival category of the transmission data group; for the abnormal synchronous arrival category of the transmission data group, the completion time difference sequence of each data stream in the transmission data group is predicted, and the completion time difference sequence is compared with the tolerable time difference sequence and the queue net space attenuation degree to determine whether the transmission data group is retransmitted. The present application monitors the transmission state and interference strength of the transmission data group, analyzes the data synchronization abnormal state of network transmission, determines whether the transmission data group is retransmitted, and improves the security and reliability of wireless networks.

Description

Technical Field

[0001] This invention relates to the field of data monitoring technology, and in particular to network security monitoring methods and systems. Background Technology

[0002] With the rapid development of the Industrial Internet of Things (IIoT) and wireless sensor networks, various automation systems and data acquisition and monitoring systems are evolving from traditional wired, closed architectures to open architectures that integrate multiple types of wireless access devices and heterogeneous network protocols. While improving system flexibility, this also significantly expands the system's network attack surface. The openness of wireless channels allows attackers to launch attacks on the data transmission process at the physical or data link layer through malicious electromagnetic interference, signal injection, and protocol hijacking, causing abnormal data stream synchronization and thus disrupting the complete reconstruction and parsing of data groups. Furthermore, existing mechanisms lack the analytical capability to correlate transport layer anomalies with network attack behavior, often misjudging synchronization anomalies caused by attacks as ordinary channel quality issues, thus masking security threats and failing to provide timely warnings.

[0003] Chinese Patent Publication No. CN101728869A discloses a novel method for monitoring the network security of power plant automation system data networks. This method utilizes the Snort detection engine within an existing power system computer network to monitor the power plant automation data network. The engine embeds communication protocols including CDT, IEC-60870-101, and IEC-61850, and establishes engine matching conditions using the frame formats of these protocols. Network security monitoring is achieved through the following two methods: a) Monitoring the content of data frames transmitted over the network, using the power plant data transmission protocol format as a benchmark; information conforming to the protocol format is allowed to continue circulating, while information not conforming is isolated; b) Monitoring the real-time traffic of the power plant data acquisition network. If abnormal network traffic is detected, it indicates abnormal data transmission on the network, and the power plant automation system data network security monitoring device will issue an alarm.

[0004] Chinese Patent Publication No. CN111092852B discloses a network security monitoring method, device, equipment, and storage medium based on big data. The method includes: real-time monitoring of traffic information, and using deep packet inspection to parse the traffic information to obtain log files corresponding to the traffic information. Then, through a log analysis framework, the corresponding log files are obtained, and the log files are filtered to obtain target log files, thereby accurately obtaining effective log files, reducing computational load and time, and ensuring the sustainability of subsequent processes. Simultaneously, the data in the target log files is subjected to anomaly attack feature analysis to obtain feature detection results. If the feature detection results indicate the presence of at least one anomaly attack feature, corresponding early warning measures are executed. This method improves the timeliness of network security monitoring by detecting effective data and providing real-time early warnings for anomalies.

[0005] However, the following problems still exist in the existing technology. Existing wireless network security protection mechanisms mostly rely on upper-layer protocol characteristics or comparison with known attack signature databases. They are difficult to dynamically perceive and process data transmission synchronization anomalies caused by malicious interference or hijacking attacks at the physical and link layers, resulting in potential security threats not being identified and warned of in a timely manner. Summary of the Invention

[0006] To address this issue, the present invention provides a network security monitoring method to solve the problem that existing security protection mechanisms are unable to detect abnormal data transmission synchronization caused by interference or attacks, resulting in the inability to identify and warn of potential security threats in a timely manner.

[0007] To achieve the above objectives, the present invention provides a network security monitoring method, comprising: Obtain the coverage area and waveform type of the wireless channel where the data transmission group is located, and obtain the instantaneous queue idle depth and instantaneous phase difference of data transmission within the data transmission group; The transmission status of the transmitted data group is analyzed based on channel overlap and instantaneous impact value. The channel overlap is determined based on the coverage area and the waveform type, and the instantaneous impact value is determined based on the instantaneous queue idle depth and the instantaneous phase difference. To address the interference transmission status of the transmitted data group, several collection points are determined to collect the arrival time difference of each data stream within the transmitted data group in real time. The fluctuation of the arrival time difference is analyzed to determine the data interference intensity and classify the synchronous arrival category of the transmitted data group. For abnormal synchronization arrival categories of the transmitted data group, the completion time difference sequence of each data stream within the transmitted data group is predicted. The completion time difference sequence is compared with the accommodating time difference sequence and the queue clearance attenuation to determine the network security status and whether the transmitted data group should be retransmitted.

[0008] Furthermore, if the transmitted data group meets the preset conditions, it is determined that there is no abnormal interference in the transmitted data group, and the transmission state is a normal transmission state. If the transmitted data group does not meet the preset conditions, it is determined that there is abnormal interference in the transmitted data group, and the transmission state is an interference transmission state. The preset conditions are that the channel overlap is less than the reference channel overlap and the instantaneous impact value is less than the reference instantaneous impact value.

[0009] Furthermore, the ratio of the bandwidth overlap width to the bandwidth of the transmitted data group is determined as the channel overlap degree; Determine the frequency band occupancy range of the remaining waveforms within the coverage area; The bandwidth occupied by the transmitted data group is compared with the bandwidth occupied by the remaining waveform on the frequency axis; The overlap between the frequency band occupied range and the frequency band occupied range of the transmitted data group is defined as the frequency band overlap width; The waveform categories include transmitted data group waveforms and remaining waveforms.

[0010] Furthermore, the instantaneous impact value is determined based on the first deviation value and the second deviation value; The deviation value between the instantaneous queue idle depth and the reference instantaneous queue idle depth is determined to be the first deviation value; The deviation value between the instantaneous phase difference and the reference instantaneous phase difference is determined to be the second deviation value.

[0011] Furthermore, the intensity of data interference is determined based on the standard deviation and mutation index of the time difference series, where, Construct a time difference sequence based on the arrival time difference corresponding to each of the aforementioned collection points; The ratio of the number of signal strength abrupt changes at a sampling point to the number of sampling points is called the abrupt change index.

[0012] Furthermore, if the data interference intensity is greater than the baseline data interference intensity, the synchronous arrival category of the transmitted data group is classified as the abnormal synchronous arrival category. If the data interference intensity is less than or equal to the baseline data interference intensity, then the synchronous arrival category of the transmitted data group is classified as the normal synchronous arrival category.

[0013] Furthermore, data fitting is performed on the signal strength of each of the aforementioned acquisition points; Determine the time difference between the completion points of each data stream; The sequence formed by the completion time differences is determined to be the completion time difference sequence.

[0014] Furthermore, the completed time difference sequence is compared item by item with the accommodative time difference sequence to determine the time synchronization offset; The clearing time required to complete the transmission of all data streams is determined based on the actual throughput and speed of the channel in which each data stream is located. Determine the ratio of the clearing duration to the preset time window; The average ratio of each of the data streams is determined as the queue clearance attenuation.

[0015] Furthermore, if each of the data streams meets the second preset condition, the network security status is normal, and the transmitted data group is not retransmitted. If any of the data streams does not meet the second preset condition, the network security status is abnormal, and the transmitted data group is retransmitted. The second preset condition is that the time synchronization offset is within the synchronization range and the queue clearance attenuation is within the attenuation range.

[0016] Furthermore, it also includes a system for a network security monitoring method, characterized in that it includes, The data acquisition module is used to acquire the coverage area and waveform type of the wireless channel where the data transmission group is located, and to acquire the instantaneous queue idle depth and instantaneous phase difference of the data transmission within the data transmission group. The analysis and evaluation module is used to analyze the transmission status of the transmitted data group based on channel overlap and instantaneous impact value. The channel overlap is determined based on the coverage area and the waveform type, and the instantaneous impact value is determined based on the instantaneous queue idle depth and the instantaneous phase difference. The category classification module is used to determine several collection points based on the interference transmission status of the transmission data group, to collect the arrival time difference of the collection points of each data stream in the transmission data group in real time, analyze the fluctuation of the arrival time difference to determine the data interference intensity, and classify the synchronous arrival category of the transmission data group. The retransmission control module is used to predict the completion time difference sequence of each data stream in the transmission data group for abnormal synchronous arrival categories, compare the completion time difference sequence with the accommodating time difference sequence and the queue clearance attenuation to determine the network security status, and determine whether to retransmit the transmission data group.

[0017] Compared with existing technologies, this invention first obtains the coverage area, waveform type, instantaneous queue idle depth, and instantaneous phase difference of the wireless channel where the transmitted data group is located. Based on the channel coverage area and waveform type, it determines the channel overlap; based on the instantaneous queue idle depth and instantaneous phase difference, it determines the instantaneous impact value and assesses the transmission status of the transmitted data group. For the interference transmission status of the transmitted data group, several sampling points are determined to collect the arrival time difference of each data stream within the transmitted data group in real time. The fluctuation of the arrival time difference is analyzed to determine the data interference intensity and classify the synchronous arrival category of the transmitted data group. For the abnormal synchronous arrival category of the transmitted data group, the completion time difference sequence of each data stream within the transmitted data group is predicted. The completion time difference sequence is compared with the accommodating time difference sequence and the queue clearance attenuation to determine whether the transmitted data group should be retransmitted. This invention improves the security and reliability of wireless networks by monitoring the transmission status and interference intensity of the transmitted data group, analyzing the abnormal data synchronization status of network transmission, and determining whether the transmitted data group should be retransmitted.

[0018] In particular, this invention determines the presence of abnormal interference in the current network by measuring channel overlap and instantaneous impact values, thereby identifying potential network attacks or security anomalies and providing a data foundation for subsequent analysis of the transmission status of transmitted data groups. In practice, existing technologies for assessing the security status of wireless networks mainly rely on statistical indicators such as packet success rate and retransmission count. These methods are post-hoc summaries and cannot perceive real-time changes in spectrum occupancy and queue status fluctuations at the physical and link layers. Furthermore, existing solutions often perform independent detection of individual data packets or make judgments based on fixed timeout windows, lacking a synchronous analysis perspective from the perspective of the entire data group. In network attack scenarios, interference signals often affect the entire frequency band of the transmitted data group or multiple data stream paths, causing non-uniform arrival time offsets in the data streams within the group. If only single packet drop or retransmission calculations are relied upon, not only will the timing disruption relationships between streams within the group be failed to be captured, but the synchronization anomalies caused by the attack will also be misjudged as ordinary channel quality problems. Based on this, the present invention considers a comprehensive analysis of channel overlap and instantaneous impact on the entire transmitted data group, thereby determining whether there is abnormal interference in the network and whether there are security issues, avoiding the lag of post-event analysis, and improving the security and reliability of wireless network data transmission.

[0019] In particular, this invention analyzes interference at several designated sampling points based on the interference transmission status of transmitted data groups, providing a data foundation for subsequently classifying the synchronous arrival categories of transmitted data groups. In practice, existing technologies judge transmission quality and thus assess network security by statistically analyzing the overall packet loss rate or average delay. However, such methods lack analysis of the individual differences among data streams within a data group. In an interference environment, different data streams within the same data group may exhibit different arrival time characteristics due to channel fading or path attenuation. This internal non-uniformity directly leads to abnormal synchronization of the data group, but the overall packet loss rate or average delay may still be within an acceptable range, thus masking the synchronization inaccuracy problem between data streams. Furthermore, existing analyses of data synchronization are mostly based on fixed timeout windows. This method cannot distinguish between normal delay deviations caused by random channel jitter and timing offsets caused by malicious interference or attacks, nor can it quantify the differences in the degree of interference experienced by each data stream. It is easy to misjudge synchronization anomalies caused by attacks as ordinary network congestion or random packet loss, thereby overlooking security threats. Based on this, the present invention considers pre-determining several collection points to analyze the time fluctuation and abrupt change of each data stream, providing a data foundation for subsequently determining the network security status and data transmission status, thereby improving the security and reliability of wireless network data transmission.

[0020] In particular, this invention predicts the completion time difference sequence of each transmitted data group based on its abnormal synchronization arrival category, and compares this completion time difference sequence with the acceptable time difference sequence and the queue clearance attenuation to determine whether to retransmit the transmitted data group. In practice, existing technologies employ a fixed retransmission strategy, triggering a retransmission request as soon as a data group is detected as not arriving in full synchronization. This approach does not consider the remaining tolerable time window of the current transmission group or the idle capacity of the collection point queue. When the tolerable time window is insufficient or the queue clearance approaches zero, forcibly initiating a retransmission not only fails to complete data completion within the effective time but also further consumes queue resources, exacerbates system congestion, and causes more data groups to fail to transmit due to timeout or overflow. Therefore, this invention, by predicting the completion time difference sequence of each transmitted data group based on its abnormal synchronization arrival category, and comparing this completion time difference sequence with the acceptable time difference sequence and the queue clearance attenuation to determine whether to retransmit the transmitted data group, achieves a multi-factor comprehensive judgment for retransmission decisions, ensuring the integrity of data group transmission and improving the security and reliability of the wireless network. Attached Figure Description

[0021] Figure 1 This is a schematic diagram illustrating the steps of the network security monitoring method according to an embodiment of the present invention; Figure 2This is a schematic diagram of the network security monitoring system according to an embodiment of the present invention; Figure 3 This is a logic block diagram illustrating the transmission status of the data group being analyzed according to an embodiment of the present invention. Figure 4 This is a logical block diagram of the synchronous arrival category of the transmission data group in an embodiment of the present invention. Figure 5 This is a logic block diagram illustrating whether or not to retransmit the transmitted data group according to an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0023] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0024] Please see Figure 1 The diagram illustrates the steps of a network security monitoring method. This embodiment includes the following steps: Step S1: Obtain the coverage area and waveform type of the wireless channel where the data transmission group is located, and obtain the instantaneous queue idle depth and instantaneous phase difference of data transmission within the data transmission group; In this embodiment of the invention, the method of obtaining the coverage range is not limited. For example, the effective coverage radius of the channel can be calculated based on the signal propagation delay and attenuation characteristics by sending a probe signal to the wireless channel and receiving its echo, thereby determining the coverage range; or the signal coverage radius information preset in the configuration parameters of the wireless access point can be obtained; of course, those skilled in the art can also use other methods, as long as the required data is obtained, which will not be elaborated here.

[0025] In this embodiment of the invention, the method of obtaining the waveform category is not limited. For example, the waveform category can be identified by analyzing the modulation and coding scheme used by the wireless channel where the transmitted data group is located, including but not limited to orthogonal frequency division multiplexing waveforms, direct sequence spread spectrum waveforms, frequency hopping spread spectrum waveforms, or single-carrier frequency domain equalization waveforms. Alternatively, a spectrum analyzer can be used to sample and analyze the radio frequency signal near the center frequency of the channel, and the waveform type can be automatically identified based on parameters such as spectrum envelope characteristics, subcarrier spacing, and cyclic prefix length. Of course, those skilled in the art can also use other methods, as long as the required data is obtained, which will not be elaborated here.

[0026] In this embodiment of the invention, the method for obtaining the queue idle depth is not limited. For example, the number of remaining available buffer units or the number of remaining storage capacity bytes in the current queue can be directly read by querying the transmission status register of the data link layer or network layer of the transmitting device, and this can be used as the instantaneous queue idle depth. Alternatively, the idle depth can be obtained by monitoring the queue's enqueue rate and dequeue rate, based on the difference between the current queue length and the maximum queue length. Of course, those skilled in the art can also use other methods, as long as the required data is obtained, which will not be elaborated here.

[0027] In this embodiment of the invention, the method of obtaining the instantaneous phase difference is not limited. For example, a synchronous reference clock can be set at the transmitting end and the acquisition point respectively, the carrier phase of the demodulated signal at the acquisition point and the local reference carrier phase can be extracted, and the instantaneous phase deviation value between the two can be used to obtain the difference. Of course, those skilled in the art can also use other methods, as long as the required data is obtained, which will not be elaborated here.

[0028] Step S2: Analyze the transmission status of the transmitted data group based on channel overlap and instantaneous impact value. The channel overlap is determined based on the coverage area and the waveform type. The instantaneous impact value is determined based on the instantaneous queue idle depth and the instantaneous phase difference. Please see Figure 3 The diagram shown is a logical block diagram of the analysis of the transmission status of a data group according to an embodiment of the present invention. Step S2, analyzing the transmission status of the data group, includes determining that if the data group meets preset conditions, the data group is free from abnormal interference and the transmission status is a normal transmission status. If the transmitted data group does not meet the preset conditions, it is determined that there is abnormal interference in the transmitted data group, and the transmission state is an interference transmission state. The preset conditions are that the channel overlap is less than the reference channel overlap and the instantaneous impact value is less than the reference instantaneous impact value.

[0029] Specifically, the baseline channel overlap is predetermined. The historical channel overlap under normal data transmission conditions is obtained in advance for several data groups, and the average of each historical channel overlap is determined as the baseline channel overlap.

[0030] Specifically, the baseline instantaneous impact value is predetermined. Several historical instantaneous impact values ​​under normal data transmission conditions are obtained in advance, and the average of each historical instantaneous impact value is determined as the baseline instantaneous impact value.

[0031] Please continue reading. Figure 1 As shown, step S2, which determines the channel overlap, includes determining the ratio of the bandwidth overlap width to the bandwidth of the transmitted data group as the channel overlap width. Determine the frequency band occupancy range of the remaining waveforms within the coverage area; The bandwidth occupied by the transmitted data group is compared with the bandwidth occupied by the remaining waveform on the frequency axis; The overlap between the frequency band occupied range and the frequency band occupied range of the transmitted data group is defined as the frequency band overlap width; The waveform categories include transmitted data group waveforms and remaining waveforms.

[0032] In this embodiment of the invention, channel overlap determines the degree of overlap in frequency band occupancy between the transmitted data group and other waveforms within the coverage area of ​​the wireless network. A higher channel overlap indicates a higher overlap ratio between the frequency band of the transmitted data group and other waveforms within the coverage area, a greater probability that the transmitted data group will experience inter-waveform interference during transmission, and a higher likelihood that the transmitted data group will be in an interference transmission state. Conversely, a lower channel overlap indicates a lower overlap ratio between the frequency band of the transmitted data group and other waveforms within the coverage area, a lower probability that the transmitted data group will experience inter-waveform interference during transmission, and a higher likelihood that the transmitted data group will be in a non-interference transmission state. Step S2, which determines the instantaneous impact value, includes determining the instantaneous impact value based on the first deviation value and the second deviation value. The deviation value between the instantaneous queue idle depth and the reference instantaneous queue idle depth is determined to be the first deviation value; The deviation value between the instantaneous phase difference and the reference instantaneous phase difference is determined to be the second deviation value.

[0033] In this embodiment of the invention, the instantaneous impact value determines the degree of internal transmission disturbance caused by the instantaneous shortage of queue resources and the instantaneous change in signal phase at the transmitting end of the transmitted data group. A larger instantaneous impact value indicates a significant decrease in the instantaneous queue idle depth relative to the reference value, thereby exacerbating the fluctuation in the time difference between the arrival of each data stream at the acquisition point, making the transmitted data group more likely to be in an interference transmission state. Conversely, a smaller instantaneous impact value indicates that the instantaneous queue idle depth is close to the reference value, the internal state at the transmitting end tends to be stable, the transmitted data group does not have the basis for causing synchronization anomalies at the source end, and the transmission state is more likely to be a normal transmission state.

[0034] Specifically, the baseline instantaneous queue idle depth is predetermined. The historical instantaneous queue idle depth under normal data transmission conditions is obtained in advance for several data groups, and the average value of the historical instantaneous queue idle depth is determined as the baseline instantaneous queue idle depth.

[0035] Specifically, the reference instantaneous phase difference is predetermined. Several historical instantaneous phase differences under normal data transmission conditions are obtained in advance, and the average of each historical instantaneous phase difference is determined as the reference instantaneous phase difference.

[0036] Step S3: For the interference transmission status of the transmission data group, determine several collection points to collect the arrival time difference of the collection points of each data stream in the transmission data group in real time, analyze the fluctuation of the arrival time difference to determine the data interference intensity, and classify the synchronous arrival category of the transmission data group. Specifically, the collection point is a physical monitoring node deployed on the wireless network transmission path, which has the functions of signal reception and timestamp recording. It is used to record the signal strength and timestamp when each data stream arrives at the physical location. There is no limit to the number of collection points, which can be determined by those skilled in the art according to the actual situation, and will not be elaborated here.

[0037] Step S3, determining the data interference intensity, includes determining the data interference intensity based on the standard deviation and mutation index of the time difference series, wherein... Construct a time difference sequence based on the arrival time difference corresponding to each of the aforementioned collection points; The ratio of the number of signal strength abrupt changes at a sampling point to the number of sampling points is called the abrupt change index.

[0038] Specifically, there is no limitation on the method for determining the standard deviation of the time difference series. For example, in this embodiment of the invention, the local standard deviation can be dynamically obtained by means of a sliding window to reflect the evolution trend of the arrival time difference fluctuation in different time periods. Of course, those skilled in the art can also use other methods, as long as the required data is obtained, which will not be elaborated here.

[0039] In this embodiment of the invention, the signal strength is obtained by directly reading the received signal strength indication output by the demodulator at the acquisition point; alternatively, it can be indirectly characterized by the channel amplitude response information carried in the channel state information. The method for determining the number of signal strength abrupt changes includes comparing the signal strength of each acquisition point with a preset strength. When the signal strength of a certain acquisition point is greater than the preset strength, it is recorded as a change. The preset strength is determined based on historical signal strength data of each acquisition point under normal transmission conditions. Of course, those skilled in the art can also use other methods, as long as the required data is obtained; these will not be elaborated further.

[0040] In this embodiment of the invention, the data interference intensity determines the degree of irregularity and non-stationarity of the arrival time of each data stream and the signal strength of the transmitted data group caused by factors such as external channel environment fluctuations, sudden noise, or malicious interference during transmission. A higher data interference intensity indicates a larger standard deviation of the time difference sequence and a larger mutation index, significantly disrupting the synchronization of each data stream. The transmitted data group is more likely to be classified as arriving out of sequence and requires subsequent retransmission determination. The smaller the data interference intensity, the smaller the standard deviation of the time difference sequence and the smaller the mutation index. The data streams maintain good synchronous arrival characteristics, and the transmitted data group is more likely to be classified as a normal synchronous arrival category, without triggering subsequent retransmission analysis.

[0041] Please see Figure 4 The diagram shown is a logical block diagram of the synchronization category of the transmission data group according to an embodiment of the present invention. Step S3, which involves classifying the synchronization arrival category of the transmission data group, includes classifying the synchronization arrival category of the transmission data group as an abnormal synchronization arrival category if the data interference intensity is greater than the reference data interference intensity. If the data interference intensity is less than or equal to the baseline data interference intensity, then the synchronous arrival category of the transmitted data group is classified as the normal synchronous arrival category.

[0042] Specifically, the baseline data interference intensity is predetermined. The historical data interference intensity under normal transmission conditions of several data groups is obtained in advance, and the average value of the historical data interference intensity is determined as the baseline data interference intensity.

[0043] Please continue reading. Figure 1 As shown, in step S4, for the abnormal synchronization arrival category of the transmitted data group, the completion time difference sequence of each data stream in the transmitted data group is predicted, the completion time difference sequence is compared with the accommodating time difference sequence and the queue clearance attenuation to determine the network security status, and it is determined whether to retransmit the transmitted data group.

[0044] Step S4, the process of predicting the completed time difference sequence, includes data fitting of the signal strength at each of the acquisition points; Determine the time difference between the completion points of each data stream; The sequence formed by the completion time differences is determined to be the completion time difference sequence.

[0045] Specifically, there is no limitation on the specific method of data fitting. In the embodiments of the present invention, a polynomial fitting method can be used for fitting. Of course, those skilled in the art can also use other methods, as long as the fitting is completed. This will not be elaborated further.

[0046] Step S4, which determines the time synchronization offset and queue clearance attenuation, includes comparing the completed time difference sequence with the accommodating time difference sequence item by item to determine the time synchronization offset. The clearing time required to complete the transmission of all data streams is determined based on the actual throughput and speed of the channel in which each data stream is located. Determine the ratio of the clearing duration to the preset time window; The average ratio of each of the data streams is determined as the queue clearance attenuation.

[0047] Specifically, the allowable time difference sequence determines the maximum allowable arrival time deviation of each data stream within the transmission data group under latency requirements. Each item in this sequence corresponds one-to-one with each data stream within the transmission data group. The acquisition method is based on the service type of the transmission data group, such as real-time control, monitoring data, or file transfer, and generates the sequence by matching the corresponding latency tolerance parameters from a preset quality of service (QoS) configuration table. The QoS configuration table is determined based on the protocol specification of the service type. Of course, those skilled in the art can also use other methods, as long as the required data is obtained; these will not be elaborated further.

[0048] The time synchronization offset is a comprehensive deviation metric obtained by comparing each item in the predicted completion time difference sequence with the acceptable time difference sequence. The time deviation of each data stream is obtained by subtracting the corresponding tolerance value from each completion time difference in the completion time difference sequence and then averaging the deviations of each data stream to obtain the global time synchronization offset.

[0049] Specifically, the actual throughput is the amount of data that each data stream is successfully transmitted in a unit of time through the transmission channel. The actual throughput reflects the effective data carrying capacity of the channel where the data stream is located under the current channel conditions, and its value is dynamically affected by factors such as channel quality, interference intensity, and retransmission overhead.

[0050] Specifically, speed refers to the actual symbol transmission rate of each data stream at the data link layer.

[0051] In this embodiment of the invention, the clearing duration is the time required to send all the untransmitted data from each data stream under the current actual throughput conditions. The clearing duration determines how long each data stream needs to complete the transmission of all data under the current transmission efficiency; the smaller the value, the more likely the data stream is about to complete transmission, and the larger the value, the longer the transmission time.

[0052] The preset time window is the maximum buffering time allowed when the transmitted data group performs data reassembly and synchronization determination at the collection point. The preset time window can be set according to the service latency requirements of the transmitted data group, the maximum capacity and latency tolerance of the collection point, system configuration parameters, or synchronization timeout thresholds specified by upper-layer applications.

[0053] Specifically, the time synchronization offset determines the overall deviation of the expected completion time of each data stream from the latest allowed completion time under abnormal synchronization conditions. A larger time synchronization offset indicates that the predicted completion time of each data stream significantly exceeds the tolerable time boundary, the lower the probability of the data stream being transmitted on time and completely, and the more likely it is to trigger retransmission; a smaller time synchronization offset indicates that the predicted completion time of each data stream is closer to or better than the tolerable time boundary, the data stream remains within a controllable range in the time dimension, and the more likely it is not to trigger retransmission.

[0054] Specifically, the queue clearance attenuation is the average of the ratio of the clearing time required for each data stream to the preset time window. It reflects the overall resource consumption of the acquisition point or sending end queue in the current interference state to handle the remaining data transmission under the time constraint of the transmitted data group.

[0055] Please see Figure 5 The diagram shown is a logical block diagram of the retransmission mechanism for transmitted data groups according to an embodiment of the present invention. Step S4, determining the network security status, includes the following: if each data stream meets a second preset condition, the network security status is normal, and the transmitted data group is not retransmitted. If any of the data streams does not meet the second preset condition, the network security status is abnormal, and the transmitted data group is retransmitted. The second preset condition is that the time synchronization offset is within the synchronization range and the queue clearance attenuation is within the attenuation range.

[0056] The synchronization range determines the maximum permissible deviation of the predicted completion time of each data stream in the transmitted data group from the allowable time difference sequence. In this embodiment of the invention, the synchronization range is set according to the service type and service quality level of the transmitted data group, and is matched with the corresponding deviation threshold in the system's preset latency tolerance configuration table. The latency tolerance is determined based on the data generation cycle or control cycle of each service type according to a preset ratio.

[0057] Within the synchronization range, it indicates that the time synchronization offset does not exceed the system's preset tolerance limit, the expected completion time of each data stream is within the deviation boundary allowed by the service latency requirements, the transmitted data group has the feasibility of timely and complete transmission in the time dimension, the network security status is not threatened by deviation factors, and there is no need to trigger retransmission due to time synchronization issues; if the time synchronization offset exceeds the synchronization range, it indicates that the predicted completion time of each data stream is delayed, the transmitted data group has a security risk of data failure due to timeout, the network security status is abnormal, and the transmitted data group is retransmitted.

[0058] Specifically, the attenuation range determines the maximum resource consumption tolerance boundary that the collection point can withstand under the current transmission pressure. The attenuation range is a pre-set resource consumption tolerance boundary used to determine whether the queue clearance attenuation is within an acceptable range. In this embodiment of the invention, the attenuation range is set according to the service type and service quality level of the transmitted data group, based on the corresponding clearing time tolerance upper limit matched in the system's preset time budget configuration table. The time budget configuration table is determined based on a time budget allocation scheme preset during the design phase.

[0059] When the queue clearance attenuation is within the attenuation range, it indicates that the queue clearance attenuation has not exceeded the system's preset resource consumption limit, the time required to clear each data stream is within a reasonable proportion of the preset time window, the queue resources will not face timeout risks due to the current transmission load, the transmitted data group has the feasibility of timely and complete transmission in the time dimension, the time deviation factor is not enough to pose a threat to network security, therefore the network security status is judged to be normal in the time dimension, and it is not necessary to retransmit the transmitted data group.

[0060] When the queue clearance decay rate is outside the decay range, it indicates that the clearing time of each data stream accounts for too high a proportion of the preset time window, exceeding the system's preset tolerance limit. Under the current actual throughput conditions, each data stream cannot complete the transmission and clearing of all remaining data within the preset time window. If the current transmission state continues, some data will remain in the queue after the time window ends, resulting in invalidation or timeout. In this case, the transmitted data group must be retransmitted to ensure the integrity and timeliness of data transmission.

[0061] Please see Figure 2 As shown, it is a schematic diagram of the network security monitoring system.

[0062] The data acquisition module is used to acquire the coverage area and waveform type of the wireless channel where the data transmission group is located, and to acquire the instantaneous queue idle depth and instantaneous phase difference of the data transmission within the data transmission group. An analysis and evaluation module, connected to the data acquisition module, is used to analyze the transmission status of the transmitted data group based on channel overlap and instantaneous impact value. The channel overlap is determined based on the coverage area and the waveform type, and the instantaneous impact value is determined based on the instantaneous queue idle depth and the instantaneous phase difference. The category classification module, which is connected to the analysis and evaluation module, is used to determine several collection points for the interference transmission status of the transmission data group, to collect the arrival time difference of the collection points of each data stream in the transmission data group in real time, analyze the fluctuation of the arrival time difference to determine the data interference intensity, and classify the synchronous arrival category of the transmission data group. A retransmission control module, connected to the category classification module, is used to predict the completion time difference sequence of each data stream in the transmission data group for the abnormal synchronous arrival category of the transmission data group, compare the completion time difference sequence with the accommodating time difference sequence and the queue clearance attenuation to determine the network security status, and determine whether to retransmit the transmission data group.

[0063] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

[0064] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network security monitoring method, characterized in that, include: Obtain the coverage area and waveform type of the wireless channel where the data transmission group is located, and obtain the instantaneous queue idle depth and instantaneous phase difference of data transmission within the data transmission group; The transmission status of the transmitted data group is analyzed based on channel overlap and instantaneous impact value. The channel overlap is determined based on the coverage area and the waveform type, and the instantaneous impact value is determined based on the instantaneous queue idle depth and the instantaneous phase difference. To address the interference transmission status of the transmitted data group, several collection points are determined to collect the arrival time difference of each data stream within the transmitted data group in real time. The fluctuation of the arrival time difference is analyzed to determine the data interference intensity and classify the synchronous arrival category of the transmitted data group. For abnormal synchronization arrival categories of the transmitted data group, the completion time difference sequence of each data stream within the transmitted data group is predicted. The completion time difference sequence is compared with the accommodating time difference sequence and the queue clearance attenuation to determine the network security status and whether the transmitted data group should be retransmitted.

2. The network security monitoring method according to claim 1, characterized in that, If the transmitted data group meets the preset conditions, it is determined that there is no abnormal interference in the transmitted data group, and the transmission state is a normal transmission state. If the transmitted data group does not meet the preset conditions, it is determined that there is abnormal interference in the transmitted data group, and the transmission state is an interference transmission state. The preset conditions are that the channel overlap is less than the reference channel overlap and the instantaneous impact value is less than the reference instantaneous impact value.

3. The network security monitoring method according to claim 1, characterized in that, The ratio of the bandwidth overlap width to the bandwidth of the transmitted data group is determined as the channel overlap degree; Determine the frequency band occupancy range of the remaining waveforms within the coverage area; The bandwidth occupied by the transmitted data group is compared with the bandwidth occupied by the remaining waveform on the frequency axis; The overlap between the frequency band occupied range and the frequency band occupied range of the transmitted data group is defined as the frequency band overlap width; The waveform categories include transmitted data group waveforms and remaining waveforms.

4. The network security monitoring method according to claim 1, characterized in that, The instantaneous impact value is determined based on the first deviation value and the second deviation value; The deviation value between the instantaneous queue idle depth and the reference instantaneous queue idle depth is determined to be the first deviation value; The deviation value between the instantaneous phase difference and the reference instantaneous phase difference is determined to be the second deviation value.

5. The network security monitoring method according to claim 1, characterized in that, The intensity of data interference is determined based on the standard deviation and mutation index of the time difference series. Construct a time difference sequence based on the arrival time difference corresponding to each of the aforementioned collection points; The ratio of the number of signal strength abrupt changes at a sampling point to the number of sampling points is called the abrupt change index.

6. The network security monitoring method according to claim 1, characterized in that, If the data interference intensity is greater than the baseline data interference intensity, then the synchronous arrival category of the transmitted data group is classified as the abnormal synchronous arrival category. If the data interference intensity is less than or equal to the baseline data interference intensity, then the synchronous arrival category of the transmitted data group is classified as the normal synchronous arrival category.

7. The network security monitoring method according to claim 1, characterized in that, Data fitting is performed on the signal strength of each of the aforementioned acquisition points; Determine the time difference between the completion points of each data stream; The sequence formed by the completion time differences is determined to be the completion time difference sequence.

8. The network security monitoring method according to claim 1, characterized in that, The time synchronization offset is determined by comparing the completed time difference sequence with the acceptable time difference sequence item by item. The clearing time required to complete the transmission of all data streams is determined based on the actual throughput and speed of the channel in which each data stream is located. Determine the ratio of the clearing duration to the preset time window; The average ratio of each of the data streams is determined as the queue clearance attenuation.

9. The network security monitoring method according to claim 8, characterized in that, If each of the data streams meets the second preset condition, the network security status is normal, and the transmitted data group will not be retransmitted. If any of the data streams does not meet the second preset condition, the network security status is abnormal, and the transmitted data group is retransmitted. The second preset condition is that the time synchronization offset is within the synchronization range and the queue clearance attenuation is within the attenuation range.

10. A system applying the network security monitoring method according to any one of claims 1-9, characterized in that, include, The data acquisition module is used to acquire the coverage area and waveform type of the wireless channel where the data transmission group is located, and to acquire the instantaneous queue idle depth and instantaneous phase difference of the data transmission within the data transmission group. The analysis and evaluation module is used to analyze the transmission status of the transmitted data group based on channel overlap and instantaneous impact value. The channel overlap is determined based on the coverage area and the waveform type, and the instantaneous impact value is determined based on the instantaneous queue idle depth and the instantaneous phase difference. The category classification module is used to determine several collection points based on the interference transmission status of the transmission data group, to collect the arrival time difference of the collection points of each data stream in the transmission data group in real time, analyze the fluctuation of the arrival time difference to determine the data interference intensity, and classify the synchronous arrival category of the transmission data group. The retransmission control module is used to predict the completion time difference sequence of each data stream in the transmission data group for abnormal synchronous arrival categories, compare the completion time difference sequence with the accommodating time difference sequence and the queue clearance attenuation to determine the network security status, and determine whether to retransmit the transmission data group.

Images