+

CN113132415A - Threat discovery system based on network flow analysis - Google Patents

Threat discovery system based on network flow analysis Download PDF

Info

Publication number
CN113132415A
CN113132415A CN202110503237.1A CN202110503237A CN113132415A CN 113132415 A CN113132415 A CN 113132415A CN 202110503237 A CN202110503237 A CN 202110503237A CN 113132415 A CN113132415 A CN 113132415A
Authority
CN
China
Prior art keywords
network
module
equipment
analysis
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110503237.1A
Other languages
Chinese (zh)
Inventor
司成
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Anhui Sipote Information Technology Co ltd
Original Assignee
Anhui Sipote Information Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Anhui Sipote Information Technology Co ltd filed Critical Anhui Sipote Information Technology Co ltd
Priority to CN202110503237.1A priority Critical patent/CN113132415A/en
Publication of CN113132415A publication Critical patent/CN113132415A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416Event detection, e.g. attack signature detection
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425Traffic logging, e.g. anomaly detection
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a threat discovery system based on network flow analysis, which comprises a plurality of data acquisition units, a network flow analysis and prediction module, a network flow control module and an audit adjustment module; the data acquisition units are used for acquiring network data streams of each device accessed to the main network; the network flow analysis module carries out statistical analysis on the acquired network data flow to obtain the current state and the future development state of each equipment network; and the network flow control module is used for controlling the network flow of each device according to the current state and the future development state of the network. When the network state of each terminal device of an enterprise is analyzed and predicted, the actual use state information of each device in the prediction stage is synchronously imported, and newly added devices in the prediction stage are synchronously imported, integrated and analyzed, so that the accuracy of analysis and prediction is obviously improved.

Description

Threat discovery system based on network flow analysis
Technical Field
The invention relates to the technical field of network traffic analysis, in particular to a threat discovery system based on network traffic analysis.
Background
With the increasing application of networks and the increasing scale of networks, the services carried in the networks are more and more abundant, and enterprises need to know the services carried in the networks in time and grasp the network traffic characteristics in time, so as to optimize the network bandwidth configuration and solve the influence of the network performance problem on daily office in time.
If application publication number is CN108696393A, application publication date is No. 10/23 in 2018, the name is 'a network traffic analysis system based on big data', and the system specifically comprises a cloud server, a network data capturing module, a network traffic monitoring module, a network traffic control module, a visual analysis management module and a communication module, wherein the network data capturing module, the network traffic monitoring module and the network traffic control module are respectively connected with the visual analysis management module, and the visual management and control module is connected with the cloud server through the communication module.
The prior art including the above application has the disadvantages that when the network flow analysis is used for analyzing and predicting the network state of each terminal device of an enterprise, the analysis and prediction of the actual use state information of the device in the prediction stage is lacked, and the synchronous import analysis of the newly added device in the prediction stage is also lacked, so that the accuracy of the analysis and prediction is influenced, and meanwhile, the requirement cannot be reasonably controlled according to the actual requirement of the device when the network flow control is carried out, and the normal and stable operation of the device is not facilitated.
Disclosure of Invention
The invention aims to provide a threat discovery system based on network flow analysis, so as to solve the defects in the prior art
In order to achieve the above purpose, the invention provides the following technical scheme: a threat discovery system based on network flow analysis comprises a plurality of data acquisition units, a network flow analysis and prediction module, a network flow control module and an audit adjustment module; the data acquisition units are used for acquiring network data streams of each device accessed to the main network; the network flow analysis module carries out statistical analysis on the acquired network data flow to obtain the current state and the future development state of each equipment network; the network flow control module is used for controlling the network flow of each device according to the current state and the future development state of the network; the auditing and adjusting module is used for importing the equipment network flow control parameters and inputting the flow characteristic parameters of each equipment for integration and analysis, so that the network flow control can be reasonably carried out on each equipment according to the equipment parameter requirements.
As a further description of the above technical solution: the data acquisition unit comprises a network data stream acquisition module; the network data flow acquisition module is used for acquiring network data flow information of corresponding equipment.
As a further description of the above technical solution: the data acquisition unit further comprises an equipment information acquisition module, wherein the equipment information acquisition module is used for acquiring corresponding equipment information and generating ID labels through the equipment information to mark each equipment.
As a further description of the above technical solution: the audit adjustment unit comprises an audit value input unit, a data calling module and an integration processing unit; the auditing value inputting unit is used for inputting the flow characteristic parameters corresponding to each device by a manager according to the office requirement of each device; the data calling module is used for acquiring network flow control parameters of each device by the network flow control module; the integration processing unit carries out network flow control parameter rationalization adjustment on each device based on the recorded flow characteristic parameters of each device, and network flow control parameters of each checked device are obtained to realize control on network flow of each device.
As a further description of the above technical solution: the auditing value inputting unit comprises an equipment information inputting module and a flow parameter inputting module; the equipment information importing module is used for importing the ID labels of the equipment; the flow parameter importing module is used for importing flow characteristic parameters of each device.
As a further description of the above technical solution: the flow characteristic parameters of the equipment are the lowest flow data parameters of the office demands of the equipment.
As a further description of the above technical solution: the network flow analysis and prediction module comprises a feature extraction processing unit and a data processing unit; the characteristic extraction processing unit is used for collecting characteristic information of the collected network data flow of each device; and the data processing unit is used for performing integration analysis according to the characteristic information of the network data stream of each device to obtain the current state of each device network.
As a further description of the above technical solution: the network flow analysis and prediction module further comprises a prediction analysis unit, and the prediction analysis unit is used for analyzing and predicting a future development state according to the characteristic information of the network data flow of each device and the current state of the network.
As a further description of the above technical solution: the prediction analysis unit comprises a data import module, an equipment state entry module and an integration analysis module, wherein the data import module is used for importing the characteristic information of network data streams of all equipment and the current state of a network, the equipment state entry module is used for entering the office state information of the equipment, and the integration analysis module is used for realizing integration analysis to accurately predict the future development state of each equipment network.
As a further description of the above technical solution: the equipment office state information comprises the office time state information of each equipment, the information of stopping office equipment in the future time period and the information of newly added office equipment.
In the technical scheme, when analyzing and predicting the network state of each terminal device of an enterprise, the threat discovery system based on network traffic analysis synchronously imports the actual use state information of each device in the prediction stage and synchronously imports, integrates and analyzes newly added devices in the prediction stage, so that the accuracy of analysis and prediction is obviously improved, and then synchronously imports traffic characteristic parameters of office demands of each device when network adjustment and control are carried out on each device according to the analysis result, so that network adjustment and control on each office device can be reasonably carried out according to the office demands of each device, and the normal, stable and reliable operation of a network is guaranteed.
Drawings
In order to more clearly illustrate the embodiments of the present application or technical solutions in the prior art, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments described in the present invention, and other drawings can be obtained by those skilled in the art according to the drawings.
Fig. 1 is an overall schematic diagram of a threat discovery system based on network traffic analysis according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of a data acquisition unit according to an embodiment of the present invention;
fig. 3 is a schematic diagram of an audit adjustment unit according to an embodiment of the present invention;
fig. 4 is a schematic diagram of an audit value entry unit according to an embodiment of the present invention;
fig. 5 is a schematic diagram of a network traffic analysis and prediction unit according to an embodiment of the present invention;
fig. 6 is a schematic diagram of a prediction analysis unit according to an embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, those skilled in the art will now describe the present invention in further detail with reference to the accompanying drawings.
Referring to fig. 1-6, an embodiment of the present invention provides a technical solution: a threat discovery system based on network flow analysis comprises a plurality of data acquisition units, a network flow analysis and prediction module, a network flow control module and an audit adjustment module; the data acquisition units are used for acquiring network data streams of each device accessed to the main network; the network flow analysis module carries out statistical analysis on the acquired network data flow to obtain the current state and the future development state of each equipment network; the network flow control module is used for controlling the network flow of each device according to the current state and the future development state of the network; the auditing and adjusting module is used for importing equipment network flow control parameters and inputting flow characteristic parameters of each equipment for integration and analysis, so that network flow control can be reasonably performed on each equipment according to the equipment parameter requirements. The data acquisition unit comprises a network data stream acquisition module; the network data flow acquisition module is used for acquiring network data flow information of the corresponding equipment. The data acquisition unit also comprises an equipment information acquisition module, and the equipment information acquisition module is used for acquiring corresponding equipment information and generating ID labels through the equipment information to mark each equipment.
Specifically, the threat discovery system based on network traffic analysis provided in this embodiment is configured to perform network traffic data acquisition on each device accessing a main network, analyze a current network state of each device according to the acquired network traffic data, predict a future development state, perform network traffic control on each device according to a current state and a future development state of the network, import each device network traffic control adjustment parameter into an audit adjustment unit, enter each device traffic characteristic parameter through the audit adjustment unit to perform integration and analysis, implement rationalization of network traffic control on each device according to a device current parameter requirement, implement network adjustment control on each office device according to an office requirement of each device, and provide guarantees for normal, stable, and reliable operation of the network.
The auditing and adjusting unit comprises an auditing value input unit, a data calling module and an integration processing unit; the auditing value inputting unit is used for inputting the flow characteristic parameters corresponding to each device by a manager according to the office requirement of each device; the office time of each device is synchronously input, and the data calling module is used for acquiring network flow control parameters of each device by the network flow control module; the integration processing unit carries out network flow control parameter rationalization adjustment on each equipment based on the recorded flow characteristic parameters of each equipment, and network flow control parameters of each equipment after auditing are obtained, so that network flow of each equipment is controlled. The auditing value input unit comprises an equipment information input module and a flow parameter input module; the equipment information importing module is used for importing the ID labels of the equipment; the flow parameter importing module is used for importing flow characteristic parameters of each device. The flow characteristic parameters of the equipment are the lowest flow data parameters of the office demands of the equipment, and the actual numerical values of the flow characteristic parameters can be obtained by measurement and calculation according to the office properties and the office demands of the equipment.
The network flow analysis and prediction module comprises a feature extraction processing unit and a data processing unit; the characteristic extraction processing unit is used for collecting characteristic information of the collected network data flow of each device; the data processing unit is used for performing integration analysis according to the characteristic information of the network data flow of each device to obtain the current state of each device network. Specifically, the feature extraction processing unit performs feature information acquisition on the acquired network data stream of each device, specifically including data packet acquisition time, a data packet source IP address, a data packet destination IP address, network capacity, bandwidth, and speed information. The network flow analysis and prediction module further comprises a prediction analysis unit, and the prediction analysis unit is used for analyzing and predicting a future development state according to the characteristic information of the network data flow of each device and the current state of the network.
The prediction analysis unit comprises a data import module, an equipment state input module and an integration analysis module, wherein the data import module is used for importing the characteristic information of network data streams of each equipment and the current state of the network, the equipment state input module is used for inputting the office state information of the equipment, and the integration analysis module realizes integration analysis to accurately predict the future development state of each equipment network. The equipment office state information comprises the office time state information of each equipment, the information of stopping office equipment in the future time period and the information of newly added office equipment. When the network state of each terminal device of an enterprise is analyzed and predicted, the actual use state information of each device in the prediction stage is synchronously imported, and the newly added devices in the prediction stage are synchronously imported, integrated and analyzed, so that the accuracy of analysis and prediction is obviously improved.
While certain exemplary embodiments of the present invention have been described above by way of illustration only, it will be apparent to those of ordinary skill in the art that the described embodiments may be modified in various different ways without departing from the spirit and scope of the invention. Accordingly, the drawings and description are illustrative in nature and should not be construed as limiting the scope of the invention.

Claims (10)

1. A threat discovery system based on network flow analysis is characterized by comprising a plurality of data acquisition units, a network flow analysis and prediction module, a network flow control module and an audit adjustment module;
the data acquisition units are used for acquiring network data streams of each device accessed to the main network;
the network flow analysis module carries out statistical analysis on the acquired network data flow to obtain the current state and the future development state of each equipment network;
the network flow control module is used for controlling the network flow of each device according to the current state and the future development state of the network;
the auditing and adjusting module is used for importing the equipment network flow control parameters and inputting the flow characteristic parameters of each equipment for integration and analysis, so that the network flow control can be reasonably carried out on each equipment according to the equipment parameter requirements.
2. The system of claim 1, wherein the data collection unit comprises a network data stream collection module; the network data flow acquisition module is used for acquiring network data flow information of corresponding equipment.
3. The threat discovery system based on network traffic analysis according to claim 1, wherein the data acquisition unit further comprises an equipment information acquisition module, the equipment information acquisition module is configured to acquire corresponding equipment information, and generate an ID label through the equipment information to label each equipment.
4. The threat discovery system based on network traffic analysis according to claim 1, wherein the audit adjustment unit includes an audit value entry unit, a data call module, and an integration processing unit;
the auditing value inputting unit is used for inputting the flow characteristic parameters corresponding to each device by a manager according to the office requirement of each device;
the data calling module is used for acquiring network flow control parameters of each device by the network flow control module;
the integration processing unit carries out network flow control parameter rationalization adjustment on each device based on the recorded flow characteristic parameters of each device, and network flow control parameters of each checked device are obtained to realize control on network flow of each device.
5. The threat discovery system based on network traffic analysis according to claim 1, wherein the audit value entry unit includes an equipment information import module and a traffic parameter import module;
the equipment information importing module is used for importing the ID labels of the equipment;
the flow parameter importing module is used for importing flow characteristic parameters of each device.
6. The threat discovery system based on network traffic analysis according to claim 5, wherein the traffic characteristic parameter of the device is a minimum traffic data parameter of office demand of each device.
7. The system of claim 1, wherein the network traffic analysis prediction module comprises a feature extraction processing unit, a data processing unit;
the characteristic extraction processing unit is used for collecting characteristic information of the collected network data flow of each device;
and the data processing unit is used for performing integration analysis according to the characteristic information of the network data stream of each device to obtain the current state of each device network.
8. The system of claim 1, wherein the network traffic analysis prediction module further comprises a prediction analysis unit, and the prediction analysis unit is configured to analyze and predict a future development state according to the feature information of the network data stream of each device and a current state of the network.
9. The threat discovery system based on network traffic analysis according to claim 8, wherein the prediction analysis unit includes a data import module, an equipment status entry module, and an integration analysis module, the data import module is used to import characteristic information of each equipment network data stream and a current network status, the equipment status entry module is used to enter equipment office status information, and the integration analysis module realizes integration analysis to accurately predict future development status of each equipment network.
10. The threat discovery system based on network traffic analysis according to claim 1, wherein the device office status information includes status information of office hours of each device, and includes information of office equipment stopped in a future time period and information of newly added office equipment.
CN202110503237.1A 2021-05-10 2021-05-10 Threat discovery system based on network flow analysis Pending CN113132415A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110503237.1A CN113132415A (en) 2021-05-10 2021-05-10 Threat discovery system based on network flow analysis

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110503237.1A CN113132415A (en) 2021-05-10 2021-05-10 Threat discovery system based on network flow analysis

Publications (1)

Publication Number Publication Date
CN113132415A true CN113132415A (en) 2021-07-16

Family

ID=76781196

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110503237.1A Pending CN113132415A (en) 2021-05-10 2021-05-10 Threat discovery system based on network flow analysis

Country Status (1)

Country Link
CN (1) CN113132415A (en)

Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020026277A1 (en) * 2000-05-10 2002-02-28 Boris Kerner Method for traffic situation determination on the basis of reporting vehicle data for a traffic network with traffic-controlled network nodes
CN1588881A (en) * 2004-07-01 2005-03-02 北京邮电大学 Method and device for controlling close ring feedback in IP network service quality management system
JP2006235772A (en) * 2005-02-23 2006-09-07 Tamotsu Yokoyama Data collection analysis display system
US20080027704A1 (en) * 2006-07-28 2008-01-31 Emerson Process Management Power & Water Solutions, Inc. Real-time synchronized control and simulation within a process plant
US20080212482A1 (en) * 2007-01-11 2008-09-04 Yoshitarou Nakayma Congestion control system, congestion control method, congestion control program, and program recording medium
CN102638409A (en) * 2012-04-27 2012-08-15 浙江工商大学 Method for controlling traffics among channels in architecture of network element based on forwarding and control separation
US20130204587A1 (en) * 2012-02-02 2013-08-08 Emerson Process Management Power & Water Solutions Inc. Enhanced sequential method for solving pressure/flow network parameters in a real-time distributed industrial process simulation system
CN107769982A (en) * 2017-11-20 2018-03-06 烽火通信科技股份有限公司 The adjustment method and system of PTN network bandwidth
CN108880888A (en) * 2018-06-20 2018-11-23 浙江工商大学 A kind of SDN network method for predicting based on deep learning
CN109873726A (en) * 2019-03-07 2019-06-11 西安交通大学 Robust service quality prediction and assurance method based on deep learning in SDN
CN109889366A (en) * 2019-01-04 2019-06-14 烽火通信科技股份有限公司 Network flow accrual accounting, analysis method and system
CN111130890A (en) * 2019-12-26 2020-05-08 深圳市高德信通信股份有限公司 Network flow dynamic prediction system

Patent Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020026277A1 (en) * 2000-05-10 2002-02-28 Boris Kerner Method for traffic situation determination on the basis of reporting vehicle data for a traffic network with traffic-controlled network nodes
CN1588881A (en) * 2004-07-01 2005-03-02 北京邮电大学 Method and device for controlling close ring feedback in IP network service quality management system
JP2006235772A (en) * 2005-02-23 2006-09-07 Tamotsu Yokoyama Data collection analysis display system
US20080027704A1 (en) * 2006-07-28 2008-01-31 Emerson Process Management Power & Water Solutions, Inc. Real-time synchronized control and simulation within a process plant
US20080212482A1 (en) * 2007-01-11 2008-09-04 Yoshitarou Nakayma Congestion control system, congestion control method, congestion control program, and program recording medium
US20130204587A1 (en) * 2012-02-02 2013-08-08 Emerson Process Management Power & Water Solutions Inc. Enhanced sequential method for solving pressure/flow network parameters in a real-time distributed industrial process simulation system
CN102638409A (en) * 2012-04-27 2012-08-15 浙江工商大学 Method for controlling traffics among channels in architecture of network element based on forwarding and control separation
CN107769982A (en) * 2017-11-20 2018-03-06 烽火通信科技股份有限公司 The adjustment method and system of PTN network bandwidth
CN108880888A (en) * 2018-06-20 2018-11-23 浙江工商大学 A kind of SDN network method for predicting based on deep learning
CN109889366A (en) * 2019-01-04 2019-06-14 烽火通信科技股份有限公司 Network flow accrual accounting, analysis method and system
CN109873726A (en) * 2019-03-07 2019-06-11 西安交通大学 Robust service quality prediction and assurance method based on deep learning in SDN
CN111130890A (en) * 2019-12-26 2020-05-08 深圳市高德信通信股份有限公司 Network flow dynamic prediction system

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
LAIJUN CHEN等: "Review and prospect of compressed air energy storage system", 《JOURNAL OF MODERN POWER SYSTEMS AND CLEAN ENERGY》 *
赵慧洁: "计算机网络模型优化算法的通用表达形式", 《现代农业》 *

Similar Documents

Publication Publication Date Title
KR101234326B1 (en) Distributed traffic analysis
Wang et al. A smart home gateway platform for data collection and awareness
CN109787833B (en) Network abnormal event sensing method and system
CN113190423B (en) Method, device and system for monitoring service data
BE1022604B1 (en) EFFICIENT MONITORING OF A DATA CENTER
CN100356729C (en) Method and system for monitoring network service performance
CN110149239B (en) Network flow monitoring method based on sFlow
US20220247650A1 (en) Network device measurements employing white boxes
US20060294148A1 (en) Network usage management system and method
CN107623611A (en) A traffic monitoring system for cloud platform virtual machines
CN101091354A (en) Analysis and Monitoring Based on Binary Classification
CN118945115B (en) Distribution processing method, system, program product and readable storage medium
CN105141446A (en) Network equipment health degree assessment method determined based on objective weight
US20220103442A1 (en) Internet of things operations monitoring system
EP1672834A1 (en) Application session management for flow-based statistics
CN108696371A (en) Network failure determines method and system
CN115766471B (en) Network service quality analysis method based on multicast flow
CN112333020A (en) Network security monitoring and data message analyzing system based on quintuple
CN109144837B (en) User behavior pattern recognition method supporting accurate service push
CN117320054A (en) Network service quality evaluation method, device, equipment and medium
CN113132415A (en) Threat discovery system based on network flow analysis
CN114095383B (en) Network flow sampling method and system and electronic equipment
US11528211B2 (en) Data inspection system for inspecting operating situations of multiple IoT devices in a plurality of target IoT systems
CN117098152A (en) Data processing method and device
CN115515173A (en) Method, system, electronic device and storage medium for analyzing performance of base station

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20210716

点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载