Method and apparatus for enhancing network security protection, storage medium and electronic device

Abstract

Disclosed are a method and apparatus for enhancing network security protection, a storage medium, and an electronic device. The method for enhancing network security protection comprises: acquiring network data received by a fixed wireless access (FWA) device, and parsing binary information and a communication protocol tree of the network data; on the basis of the binary information and the communication protocol tree, determining whether a network security threat is present in the network data; when a network security threat is present, intercepting the network data, and performing alert reporting on the basis of the intercepted network data.

Description

Enhanced network security protection method and device, storage medium, and electronic device

[0001] Citation of Related Applications

[0002] This disclosure claims all rights and interests in the Chinese invention patent application with application number 202410089140.4, filed with the State Intellectual Property Office of the People's Republic of China on January 22, 2024, entitled "Enhanced Network Security Protection Method and Device, Storage Medium, Electronic Device", and incorporates the entire contents thereof into this disclosure by reference.

[0003] field

[0004] The present disclosure generally relates to the field of network security technology, and more particularly to methods and devices for enhancing network security protection.

[0005] background

[0006] In the past, there were virtually no suitable internet access solutions for areas where wired cables couldn't be laid. However, with the widespread adoption of 5G technology, the more flexible FWA (Fixed Wireless Access) solution has replaced wired cables as the "last mile" solution. The widespread adoption of 5G technology has also ushered in the era of the Internet of Things. However, smart homes, due to their long-term connectivity, limited computing resources, and lack of automatic updates, present significant network security risks.

[0007] Network security protection primarily relies on blacklists and whitelists and simple ACL (Access Control List) matching rules. Filtering is performed based on configured rules. If a match is found, the packet is released; if a match is found, the packet is intercepted according to the rules. However, with the emergence of a growing number of new network attack techniques, the effectiveness of the rule-based or signature-based detection solutions currently used in the industry is declining. Network threat detection methods are primarily based on feature rules and machine learning. Rule-based detection methods require network security experts to generate matching rules for known threats. Faced with the increasing complexity and diversity of network attacks, these solutions suffer from high false positive rates, poor adaptability, and low detection rates. They also lack the ability to dynamically detect emerging, unknown threats. Traditional machine learning-based solutions require artificially constructing threat signatures through feature engineering and then training the machine learning model. The model's detection effectiveness depends largely on the quality of the feature model. Once the threat model changes, the detection hit rate decreases. Traditional machine learning algorithms are ineffective against unknown network security threats.

[0008] Overview

[0009] On the one hand, the present disclosure provides a method for enhancing network security protection, which includes: obtaining network data received by a fixed wireless access (FWA) device, parsing binary information and a communication protocol tree of the network data; determining whether the network data presents a network security threat based on the binary information and the communication protocol tree; and if a network security threat exists, intercepting the network data and reporting an alarm based on the intercepted network data.

[0010] In certain embodiments, parsing the binary information and communication protocol tree of the network data includes: receiving an original data message of the network data, wherein the original data message includes multiple sub-messages; copying the original data message of the network data to obtain a mirror data message; extracting binary information from the mirror data message; performing message reassembly on the multiple sub-messages to obtain reassembled network data; copying the reassembled network data to obtain mirror network data; and parsing all communication protocols in the mirror network data to obtain a communication protocol tree for the network data.

[0011] In certain embodiments, determining whether the network data poses a network security threat based on the binary information and the communication protocol tree includes: matching the binary information and the communication protocol tree using a preset feature library to determine whether the network data poses a network security threat.

[0012] In certain embodiments, the preset feature library includes a preset virus feature library and a preset intrusion rule feature library, and the preset feature library is used to match the binary information and the communication protocol tree to determine whether the network data has a network security threat, including: comparing the preset virus feature library and the binary information; determining whether the preset virus feature library matches the binary information; if the virus feature library matches the binary information, determining that the network data has a network security threat; if the virus feature library does not match the binary information, determining whether the preset intrusion rule feature library matches the communication protocol tree; if the preset intrusion rule feature library matches the communication protocol tree, determining that the network data has a network security threat.

[0013] In certain embodiments, determining whether the network data is subject to a network security threat based on the binary information and the communication protocol tree also includes: reporting the binary information and the communication protocol to a security threat analysis platform of a cloud server; and receiving an analysis result returned by the cloud server based on the binary information and the communication protocol, wherein the analysis result is used to indicate whether the network data is subject to a network security threat.

[0014] In certain embodiments, after intercepting the network data, the method for enhancing network security protection includes: extracting characteristic information of the network data; writing the characteristic information into a system database and generating an interception log; and sending the interception log and the characteristic information to a security threat analysis platform, so that the security threat analysis platform performs big data analysis to obtain deep characteristic information of the characteristic information.

[0015] In certain embodiments, after sending the interception log and the feature information to the security threat analysis platform, the method for enhancing network security protection includes: receiving the deep feature information sent by the security threat analysis platform via the air interface FOTA; and updating the preset feature library using the deep feature information.

[0016] On the other hand, the present disclosure provides an enhanced network security protection device, which includes: an acquisition module, configured to acquire network data received by a fixed wireless access (FWA) device, and parse the binary information and communication protocol tree of the network data; a judgment module, configured to judge whether the network data poses a network security threat based on the binary information and the communication protocol tree; and an interception module, configured to intercept the network data if a network security threat exists, and to report an alarm based on the intercepted network data.

[0017] In certain embodiments, the acquisition module includes: a receiving unit configured to receive an original data message of the network data, wherein the original data message includes multiple sub-messages; a first copying unit configured to copy the original data message of the network data to obtain a mirror data message; an extraction unit configured to extract binary information from the mirror data message; a reassembly unit configured to perform message reassembly on the multiple sub-messages to obtain reassembled network data; a second copying unit configured to copy the reassembled network data to obtain mirror network data; and a parsing unit configured to parse all communication protocols in the mirror network data to obtain a communication protocol tree for the network data.

[0018] In certain embodiments, the judgment module includes: a matching unit configured to match the binary information with the communication protocol tree using a preset feature library to determine whether the network data poses a network security threat.

[0019] In certain embodiments, the matching unit includes: a comparison subunit, configured to compare a preset virus feature library and the binary information; a first judgment subunit, configured to determine whether the preset virus feature library matches the binary information; a first determination subunit, configured to determine that a network security threat exists in the network data if the virus feature library matches the binary information; a second judgment subunit, configured to determine whether a preset intrusion rule feature library matches the communication protocol tree if the virus feature library does not match the binary information; and a second determination subunit, configured to determine that a network security threat exists in the network data if the preset intrusion rule feature library matches the communication protocol tree.

[0020] In certain embodiments, the judgment module further includes: a reporting unit configured to report the binary information and the communication protocol to a security threat analysis platform of a cloud server; and a receiving unit configured to receive an analysis result returned by the cloud server based on the binary information and the communication protocol, wherein the analysis result is used to indicate whether the network data poses a network security threat.

[0021] In certain embodiments, the enhanced network security protection device also includes: an extraction module configured to extract characteristic information of the network data; a writing module configured to write the characteristic information into a system database and generate an interception log; and a sending module configured to send the interception log and the characteristic information to a security threat analysis platform, so that the security threat analysis platform performs big data analysis to obtain deep characteristic information of the characteristic information.

[0022] In certain embodiments, the enhanced network security protection device also includes: a receiving module configured to receive the deep feature information sent by the security threat analysis platform via an air interface FOTA; and an updating module configured to update a preset feature library using the deep feature information.

[0023] On the other hand, the present disclosure further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the enhanced network security protection method of the present disclosure when running.

[0024] On the other hand, the present disclosure further provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the enhanced network security protection method of the present disclosure.

[0025] In certain embodiments, by acquiring network data received by the FWA device, parsing the binary information and communication protocol tree of the network data, and then determining whether the network data poses a network security threat based on the binary information and the communication protocol tree, and intercepting the network data if a network security threat exists, the technical problem of being unable to provide network security protection for the FWA device is solved, the security monitoring and protection capabilities of the FWA device are improved, and the detection and adaptability capabilities of the FWA device to unknown threats in the target domain are improved.

[0026] BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation of the present disclosure. In the drawings:

[0028] FIG1 is a block diagram of the hardware structure of a server according to an embodiment of the present disclosure;

[0029] FIG2 is a flow chart of a method for enhancing network security protection according to an embodiment of the present disclosure;

[0030] FIG3 is an example diagram of a binary file string of a virus according to an embodiment of the present disclosure;

[0031] 4 is a flow chart of determining whether an intrusion rule signature library matches a communication protocol tree according to an embodiment of the present disclosure;

[0032] FIG5 is an overall flow chart of a bypass monitoring strategy according to an embodiment of the present disclosure;

[0033] FIG6 is a flowchart of reporting suspicious data to a cloud server according to an embodiment of the present disclosure;

[0034] FIG7 is a flowchart of updating a local feature library according to an embodiment of the present disclosure;

[0035] FIG8 is an overall flow chart of a method for enhancing network security protection according to an embodiment of the present disclosure;

[0036] FIG9 is a flowchart of the interaction between the security threat analysis platform and the FWA device according to an embodiment of the present disclosure;

[0037] FIG10 is a structural position diagram of an FWA device in the Internet of Things according to an embodiment of the present disclosure; and

[0038] FIG11 is a structural block diagram of a device for enhancing network security protection according to an embodiment of the present disclosure.

[0039] Details

[0040] In order to enable those skilled in the art to better understand the solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present disclosure. It should be noted that the embodiments in the present disclosure and the features in the embodiments can be combined with each other unless there is a conflict.

[0041] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way are interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0042] Example 1

[0043] The method embodiment provided in the first embodiment of the present disclosure can be executed in a server, a computer, a FWA device, or a similar computing device. Taking operation on a server as an example, FIG1 is a hardware structure block diagram of a server in an embodiment of the present disclosure. As shown in FIG1 , the server may include one or more (only one is shown in FIG1 ) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 configured to store data. In certain embodiments, the above-mentioned server may also include a transmission device 106 and an input / output device 108 for communication functions. It will be understood by those skilled in the art that the structure shown in FIG1 is merely illustrative and does not limit the structure of the above-mentioned server. In certain embodiments, the server may also include more or fewer components than shown in FIG1 , or have a configuration different from that shown in FIG1 .

[0044] The memory 104 can be configured to store server programs, for example, software programs and modules of application software, such as a server program corresponding to a method for enhancing network security protection in an embodiment of the present disclosure. The processor 102 executes various functional applications and data processing by running the server program stored in the memory 104, that is, implementing the above method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In certain embodiments, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the server via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0045] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the server's communications provider. In some embodiments, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In some embodiments, the transmission device 106 may be a radio frequency (RF) module configured to communicate with the Internet wirelessly.

[0046] In this embodiment, a method for enhancing network security protection is provided. FIG2 is a flow chart of the method for enhancing network security protection according to an embodiment of the present disclosure. As shown in FIG2 , the process includes the following steps:

[0047] Step S202: obtaining network data received by a fixed wireless access (FWA) device, and parsing binary information and a communication protocol tree of the network data;

[0048] Step S204, judging whether the network data has a network security threat according to the binary information and the communication protocol tree; and

[0049] Step S206: When there is a network security threat, the network data is intercepted, and an alarm is reported based on the intercepted network data.

[0050] In certain embodiments, a network probe is used to obtain all data streams received by the FWA device (including those flowing into the external network and out of the internal network). The network data is classified by protocol stack, including: data packets based on the physical layer / MAC layer, focusing on data packet size, arrival time, interval between consecutive data packets, etc.; data packets based on the protocol layer, mainly focusing on the five-tuple (source IP, source port, destination IP, destination port, protocol type), and spatiotemporal characteristics (such as the duration of a data packet of a certain host, or a certain type of protocol, the number of bytes sent, round-trip time, number of retransmissions, etc.).

[0051] In certain embodiments, the network security threats include, but are not limited to: DoS denial of service, malicious code (such as mining and ransomware) / worms / viruses, and packet sniffing (including Trojans and spam (obtaining user sensitive information through phishing)); these network attacks may come from hackers, vulnerabilities in the software itself, or even active attacks by internal zombie hosts or personnel.

[0052] In certain embodiments, by obtaining network data received by the FWA device, parsing the binary information and communication protocol tree of the network data, and then judging whether the network data poses a network security threat based on the binary information and the communication protocol tree, and intercepting the network data if a network security threat exists, the technical problem that related technologies cannot provide network security protection for FWA devices is solved, the security monitoring and protection capabilities of the FWA device are improved, and the detection and adaptability capabilities of the FWA device to unknown threats in the target domain are improved.

[0053] In certain embodiments, parsing the binary information and communication protocol tree of the network data includes: receiving an original data message of the network data, wherein the original data message includes multiple sub-messages; copying the original data message of the network data to obtain a mirror data message; extracting binary information from the mirror data message; performing message reassembly on the multiple sub-messages to obtain reassembled network data; copying the reassembled network data to obtain mirror network data; and parsing all communication protocols in the mirror network data to obtain a communication protocol tree for the network data.

[0054] In certain embodiments, the present disclosure extracts binary information from mirrored data packets of the original data packet and parses the communication protocol in the mirrored network data using bypass monitoring technology. Bypass monitoring technology is a monitoring mechanism suitable for high-speed backbone network broadband and high-concurrency scenarios, with high-speed matching and precise protocol parsing. With a high-speed matching algorithm as the core, the present disclosure uses a local threat analysis engine. When the FWA receives a data packet, the internal switch will copy each original data packet of the received network data to the mirrored port in real time, and then further analyze and process the data packets received by the mirrored port. The advantage of the bypass monitoring mode is that it analyzes and processes the data copied from the mirrored port without causing any delay to the originally transmitted data packet and without affecting the network speed.

[0055] In certain embodiments, determining whether the network data poses a network security threat based on the binary information and the communication protocol tree includes: matching the binary information and the communication protocol tree using a preset feature library to determine whether the network data poses a network security threat.

[0056] In certain embodiments, the preset feature library includes a preset virus feature library and a preset intrusion rule feature library, and the preset feature library is used to match the binary information and the communication protocol tree to determine whether the network data has a network security threat, including: comparing the preset virus feature library and the binary information; determining whether the preset virus feature library matches the binary information; if the virus feature library matches the binary information, determining that the network data has a network security threat; if the virus feature library does not match the binary information, determining whether the preset intrusion rule feature library matches the communication protocol tree; if the preset intrusion rule feature library matches the communication protocol tree, determining that the network data has a network security threat.

[0057] In certain embodiments, the present disclosure uses a binary matching method to perform network security threat analysis by determining whether a preset virus signature library matches the binary information, that is, directly comparing the preset virus signature library with the binary information in the mirror data message. The local threat analysis engine can directly identify the IP address, protocol type, and port in the binary information. There are always some identifiable strings in the virus file. In many cases, these strings are unique to a certain virus. Therefore, by using the local threat analysis engine to compare the binary information with the preset virus signature library, it is possible to not only find out whether the network data has a network security threat, but also to extract the signature codes of all viruses.

[0058] FIG3 is an example diagram of a binary file string of a virus according to an embodiment of the present disclosure. As shown in FIG3 , after reverse engineering of the “Panda Burning Incense” virus, the binary file of the virus initially contains the two strings “xboy” and “whboy”, which can be used as one of the preset virus feature libraries.

[0059] In certain embodiments, determining whether a preset intrusion rule feature library matches the communication protocol tree includes: disassembling the communication protocol tree layer by layer to obtain a communication protocol set; and determining whether there is a specified communication protocol in the communication protocol set that hits the intrusion rule feature library, wherein the intrusion rule feature library includes: a routing quintuple and protocol spatiotemporal features, and the spatiotemporal features include: duration of a data packet, number of bytes sent, round-trip time, and number of retransmissions; if there is a specified communication protocol in the communication protocol set that hits the intrusion rule feature library, determining that the preset intrusion rule feature library matches the communication protocol tree; if there is no specified communication protocol in the communication protocol set that hits the intrusion rule feature library, determining that the preset intrusion rule feature library does not match the communication protocol tree.

[0060] In certain implementations, intrusion detection is the process of identifying intrusion behaviors based on an intrusion rule signature library. These behaviors include various IP sniffing, vulnerability scanning, and port scanning. Typically, most network attack behaviors are strongly correlated with specific network protocols and services. The local threat analysis engine rapidly detects network intrusions by importing rule sets from the intrusion rule signature library and performing signature matching against communication protocol sets. The security threat analysis platform then updates the intrusion rule signature library to improve detection accuracy and efficiency.

[0061] Figure 4 is a flowchart of an embodiment of the present disclosure for determining whether the intrusion rule feature library matches the communication protocol tree. As shown in Figure 4, the local threat analysis engine parses the protocol tree and imports the parsing results into the intrusion rule feature library, disassembles the protocol tree layer by layer to obtain multi-layer protocols and matches each layer of protocols with the intrusion rule feature library to obtain multiple rule subsets.

[0062] FIG5 is an overall flow chart of a bypass monitoring strategy according to an embodiment of the present disclosure. As shown in FIG5 , FWA forwards network data packets, then reassembles the data packets. If there is no abnormality, the data is forwarded normally and the data is sent down. During data forwarding, the local threat analysis engine uses the bypass monitoring mode to copy the data to obtain mirror data, and then performs binary matching on the data packets to determine whether they are abnormal. If the match is abnormal, the network data is intercepted. If the match is normal, the local threat analysis engine uses the bypass monitoring mode to perform protocol analysis and threat identification on the complete network data. If there is an abnormality, the data is intercepted and an alarm is reported, and the abnormal network data is recorded in the log. If there is no abnormality, the network data is forwarded normally.

[0063] In certain embodiments, determining whether the network data is subject to a network security threat based on the binary information and the communication protocol tree also includes: reporting the binary information and the communication protocol to a security threat analysis platform of a cloud server; and receiving an analysis result returned by the cloud server based on the binary information and the communication protocol, wherein the analysis result is used to indicate whether the network data is subject to a network security threat.

[0064] FIG6 is a flowchart of reporting suspicious data to a cloud server for detecting suspicious data according to an embodiment of the present disclosure. As shown in FIG6 , multiple FWA terminals report suspicious data to a security threat analysis platform of a cloud server via a 4G / 5G network. The suspicious threat sample collection module of the security threat analysis platform receives the suspicious data and stores the data in a sample storage database. The suspicious sample analysis and processing module of the security threat analysis platform obtains the security threat analysis results and feature information of the suspicious data through machine learning and deep learning, and loads the feature information into a virus feature library. Finally, the cloud detection and killing interaction module returns the security threat analysis results and an updated virus feature library. Directly reporting suspicious data streams, and having the security threat analysis platform located on the cloud server analyze the binary information and the communication protocol to determine whether the network data poses a network security threat, can effectively reduce the processing power overhead of the terminal.

[0065] In certain embodiments, after intercepting the network data, the method for enhancing network security protection includes: extracting characteristic information of the network data; writing the characteristic information into a system database and generating an interception log; sending the interception log and the characteristic information to a security threat analysis platform, so that the security threat analysis platform performs big data analysis to obtain in-depth characteristic information of the characteristic information.

[0066] In certain embodiments, the feature information includes a specified communication protocol in a communication protocol set that hits an intrusion rule feature library and binary information that matches a virus feature library.

[0067] In some embodiments, the interception log includes the timestamp of the interception of the network data, the event description, and the location of the event, written into the log file. Whether the log is sent to the security threat analysis platform does not affect the generation of deep feature information.

[0068] In certain embodiments, after sending the interception log and the feature information to the security threat analysis platform, the method includes: receiving the deep feature information sent by the security threat analysis platform via the air interface FOTA; and updating the preset feature library using the deep feature information.

[0069] S11, connects to the security threat analysis platform of the cloud server through a trusted agent.

[0070] In some implementations, both the FWA device and the cloud server have pre-installed digital certificates from the same trusted CA. This ensures bidirectional authentication, ensuring the authenticity of the data source. Data sent between the two parties (for reporting suspicious logs or downloading updated signature or virus databases) is encrypted using HTTPS (Hypertext Transfer Protocol Secure) or TLS (Transport Layer Security) to ensure secure transmission.

[0071] S12, sending the feature information to the security threat analysis platform for big data analysis to obtain deep feature information of the feature information.

[0072] In certain implementation schemes, the security threat analysis platform is trained through deep learning algorithms and transfer learning algorithms, and is based on a network unknown threat detection algorithm based on deep domain adaptation, combined with deep domain adaptation and adversarial learning algorithms. It not only has good adaptability, but the system can also realize intelligent migration from the source domain to the target domain. It has a wide range of applications and can improve the ability to detect unknown threats in the target domain.

[0073] S13: Update the local feature library using the depth feature information.

[0074] Figure 7 is a flowchart of updating the local feature library according to an embodiment of the present disclosure. As shown in Figure 7, using the depth feature information to update the local feature library includes: the FWA network interface reports a log containing data through the network, the cloud server performs big data processing on the log and returns a feature library containing the depth feature information, and after the FWA downloads the feature library containing the depth feature information, it first verifies the feature library and then decompresses it and imports it into the local database.

[0075] FIG8 is an overall flow chart of a method for enhancing network security protection according to an embodiment of the present disclosure. As shown in FIG8 , the process includes the following steps:

[0076] S81: The switch copies the received network data to the mirror port in real time and then performs further analysis and processing on the network data received by the mirror port. The further analysis and processing includes binary matching, message reassembly, and protocol identification.

[0077] S82 uses the local threat analysis engine to compare the intrusion rule signature library with the network data protocol, and the virus signature library with the binary information. If no threat is detected, the data is released normally. If a threat is detected, the data is intercepted and an alarm is reported on the UI interface, and the characteristic information of the abnormal network data is recorded in the log.

[0078] S83, a security threat analysis platform that reports abnormal network data from the database to the server for big data training of machine learning and deep learning algorithms; and

[0079] S84, after training, the security threat analysis platform returns the deep feature information and updates the local feature library based on the deep information.

[0080] Figure 9 is a flowchart of the interaction between the security threat analysis platform and FWA devices according to an embodiment of the present disclosure. As shown in Figure 9, FWA detects a threat and reports it to the platform. The security threat analysis platform then performs big data analysis on the threat, trains a powerful threat signature matching strategy using massive threat sample data, and then distributes the latest threat signature matching strategy to the FWA. Figure 10 is a structural diagram of the FWA device in the Internet of Things according to an embodiment of the present disclosure. As shown in Figure 10, the FWA device connects between the 5G network and various smart home devices, transmitting the network and providing broadband connectivity for smart home devices. The FWA device also exchanges data with smart home devices.

[0081] The solution of this embodiment provides a security protection architecture combining a network-side security threat analysis platform and a local FWA detection node. Deep learning algorithms are also introduced to enable intrusion monitoring of abnormal behavior in FWA devices and detect unknown threats. Deployed on a large number of FWA devices, this provides a large amount of network security threat data samples. This large amount of sample data is used to train the AI ​​algorithms of the security threat analysis platform, continuously optimizing rules and policies and improving the system's anti-virus and anti-threat intrusion capabilities (particularly its ability to monitor and identify unknown threats). This effectively enhances the network security protection of smart homes and IoT devices in countless households. This architecture provides network security protection for FWA devices. Furthermore, the cloud server's security threat analysis platform employs deep learning and transfer learning algorithms to train a deep domain adaptive network unknown threat detection algorithm, combined with an adversarial learning algorithm. The deep feature information obtained from the training is used to update the local feature library, improving the FWA device's detection and adaptive capabilities for unknown threats in the target domain.

[0082] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0083] Example 2

[0084] This embodiment also provides a device for enhancing network security. The device is configured to implement the above-mentioned embodiments and implementation schemes, and details already described will not be repeated. As used below, the term "module" may refer to a combination of software and hardware that implements the specified functions. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also contemplated.

[0085] FIG11 is a structural block diagram of a device for enhancing network security protection according to an embodiment of the present disclosure. As shown in FIG11 , the device includes:

[0086] An acquisition module 110 is configured to acquire network data received by a fixed wireless access (FWA) device and parse binary information and a communication protocol tree of the network data;

[0087] A judgment module 112 is configured to judge whether the network data has a network security threat based on the binary information and the communication protocol tree;

[0088] The interception module 114 is configured to intercept the network data when there is a network security threat, and to generate an alarm based on the intercepted network data.

[0089] In certain embodiments, the acquisition module includes: a receiving unit configured to receive an original data message of the network data, wherein the original data message includes multiple sub-messages; a first copying unit configured to copy the original data message of the network data to obtain a mirror data message; an extraction unit configured to extract binary information from the mirror data message; a reassembly unit configured to perform message reassembly on the multiple sub-messages to obtain reassembled network data; a second copying unit configured to copy the reassembled network data to obtain mirror network data; and a parsing unit configured to parse all communication protocols in the mirror network data to obtain a communication protocol tree for the network data.

[0090] In certain embodiments, the judgment module includes: a matching unit configured to match the binary information with the communication protocol tree using a preset feature library to determine whether the network data poses a network security threat.

[0091] In certain embodiments, the matching unit includes: a comparison subunit, configured to compare a preset virus feature library and the binary information; a first judgment subunit, configured to determine whether the preset virus feature library matches the binary information; a first determination subunit, configured to determine that a network security threat exists in the network data if the virus feature library matches the binary information; a second judgment subunit, configured to determine whether a preset intrusion rule feature library matches the communication protocol tree if the virus feature library does not match the binary information; and a second determination subunit, configured to determine that a network security threat exists in the network data if the preset intrusion rule feature library matches the communication protocol tree.

[0092] In certain embodiments, the judgment module further includes: a reporting unit configured to report the binary information and the communication protocol to a security threat analysis platform of a cloud server; and a receiving unit configured to receive an analysis result returned by the cloud server based on the binary information and the communication protocol, wherein the analysis result is used to indicate whether the network data poses a network security threat.

[0093] In certain embodiments, the enhanced network security protection device also includes: an extraction module configured to extract characteristic information of the network data; a writing module configured to write the characteristic information into a system database and generate an interception log; and a sending module configured to send the interception log and the characteristic information to a security threat analysis platform, so that the security threat analysis platform performs big data analysis to obtain deep characteristic information of the characteristic information.

[0094] In certain embodiments, the enhanced network security protection device also includes: a receiving module configured to receive the deep feature information sent by the security threat analysis platform via an air interface FOTA; and an updating module configured to update a preset feature library using the deep feature information.

[0095] Example 3

[0096] An embodiment of the present disclosure further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the method for enhancing network security protection of the present disclosure when running.

[0097] In certain embodiments, in this example, the above-mentioned storage medium may be configured to store a computer program for executing:

[0098] S1, obtaining network data received by a fixed wireless access (FWA) device, and parsing binary information and a communication protocol tree of the network data;

[0099] S2, judging whether the network data has a network security threat according to the binary information and the communication protocol tree; and

[0100] S3: When there is a network security threat, intercept the network data and report an alarm based on the intercepted network data.

[0101] In some embodiments, the above-mentioned storage medium may include, but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0102] An embodiment of the present disclosure further provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the method for enhancing network security protection of the present disclosure.

[0103] In some embodiments, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0104] In some embodiments, the processor may be configured to perform the following steps via a computer program:

[0105] S1, obtaining network data received by a fixed wireless access (FWA) device, and parsing binary information and a communication protocol tree of the network data;

[0106] S2, judging whether the network data has a network security threat according to the binary information and the communication protocol tree; and

[0107] S3: When there is a network security threat, intercept the network data and report an alarm based on the intercepted network data.

[0108] For specific examples in this embodiment, reference can be made to the examples described in the above embodiments and optional implementation schemes, and this embodiment will not be described in detail here.

[0109] The serial numbers of the above-mentioned embodiments of the present disclosure are for description only and do not represent the advantages or disadvantages of the embodiments.

[0110] In the above embodiments of the present disclosure, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0111] In the several embodiments provided in this disclosure, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0112] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0113] In addition, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0115] The above are only some embodiments of the present disclosure. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present disclosure. These improvements and modifications should also be regarded as within the scope of protection of the present disclosure.

Claims

1. Enhanced network security protection method, which includes: Obtaining network data received by a fixed wireless access (FWA) device, and parsing the binary information and communication protocol tree of the network data; Judging whether there is a network security threat in the network data according to the binary information and the communication protocol tree; And In the case of a network security threat, intercepting the network data and reporting an alarm based on the intercepted network data.

2. The enhanced network security protection method according to claim 1, wherein parsing the binary information and communication protocol tree of the network data includes: Receiving the original data packet of the network data, wherein the original data packet includes a plurality of sub-packets; Copying the original data packet of the network data to obtain a mirrored data packet; Extracting the binary information from the mirrored data packet; Recombining the plurality of sub-packets to obtain recombined network data; Copying the recombined network data to obtain a mirrored network data; and Parsing all communication protocols in the mirrored network data to obtain the communication protocol tree of the network data.

3. The enhanced network security protection method according to claim 1 or 2, wherein judging whether there is a network security threat in the network data according to the binary information and the communication protocol tree includes: Using a preset feature library to match the binary information and the communication protocol tree to judge whether there is a network security threat in the network data.

4. The enhanced network security protection method according to claim 3, wherein the preset feature library includes a preset virus feature library and a preset intrusion rule feature library. Using the preset feature library to match the binary information and the communication protocol tree to judge whether there is a network security threat in the network data includes: Comparing the preset virus feature library with the binary information; Judging whether the preset virus feature library matches the binary information; If the virus feature library matches the binary information, determining that there is a network security threat in the network data; If the virus feature library does not match the binary information, judging whether the preset intrusion rule feature library matches the communication protocol tree; If the preset intrusion rule feature library matches the communication protocol tree, determining that there is a network security threat in the network data.

5. The enhanced network security protection method according to any one of claims 1 to 4, wherein judging whether there is a network security threat in the network data according to the binary information and the communication protocol tree further includes: [[ID=2I]]Reporting the binary information and the communication protocol to the security threat analysis platform of the cloud server; And Receiving the analysis result returned by the cloud server based on the binary information and the communication protocol, wherein the analysis result is used to indicate whether there is a network security threat in the network data.

6. The enhanced network security protection method according to any one of claims 1 to 5, wherein after intercepting the network data, the enhanced network security protection method includes: Extracting the feature information of the network data; Writing the feature information into the system database and generating an interception log; And Send the intercepted log and the feature information to a security threat analysis platform so that the security threat analysis platform can perform big data analysis to obtain in-depth feature information of the feature information.

7. The enhanced network security protection method according to claim 6, wherein after sending the intercepted log and the feature information to the security threat analysis platform, the enhanced network security protection method includes: Receiving, through an air interface FOTA, the in-depth feature information sent by the security threat analysis platform; And Updating a preset feature library by using the in-depth feature information.

8. An enhanced network security protection device, comprising: An acquisition module configured to acquire network data received by a fixed wireless access FWA device, and parse binary information and a communication protocol tree of the network data; A judgment module configured to judge whether there is a network security threat in the network data according to the binary information and the communication protocol tree; And An interception module configured to intercept the network data in the case of a network security threat, and perform alarm reporting based on the intercepted network data.

9. A storage medium, in which a computer program is stored, wherein the computer program is set to execute the enhanced network security protection method according to any one of claims 1 to 7 when running.

10. An electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is set to run the computer program to execute the enhanced network security protection method according to any one of claims 1 to 7.

Images