CN109462621A - Network safety protective method, device and electronic equipment - Google Patents

Abstract

The present invention provides a network security protection method, device and electronic device. The method includes: a network security protection device sends a data collection request to a protected device, and then receives data response information returned by the protected device according to the data collection request; The traffic data and security event data are compared and analyzed with the standard information to obtain the comparative analysis result; and when the comparative analysis result is that there is an abnormal event, the communication of the abnormal event is blocked. The network security protection device of the present invention can actively collect data, and in addition, the returned data response information includes traffic data, that is, it is possible to monitor traffic abnormality, and the monitoring accuracy is improved. It can block the communication of abnormal events, and alleviate the technical problems that the existing network security protection method can only passively accept data, the false positive rate is high, and the security protection is lacking.

Description

Network security protection method, device and electronic device

technical field

The present invention relates to the technical field of network communication, and in particular, to a network security protection method, device and electronic device.

Background technique

As shown in Figure 1, in the existing network security management system, the network security monitoring device is deployed on-site at the station control layer to realize the network security of the related equipment in the area (including the monitoring system of the control agency, power distribution of the plant and station, and negative control). Data collection and processing, and at the same time, the processing results are sent to the network security supervision platform deployed by the dispatching agency through communication means according to the set communication protocol.

The specific implementation process is as follows: Install the monitoring system client program on each protected device (including: host equipment, network equipment, security equipment, firewall, etc.), and based on the monitoring system client program, the protected device reports to the network security monitoring device Initiate a connection establishment request, so that the protected device establishes a TCP connection with the network security monitoring device, and then the protected device sends network security data to the network security monitoring device. For example, the host device sends the operating system level to the network security monitoring device. Operation information, access information of peripheral devices (keyboard, mouse, and many mobile storage devices) and network security data such as network outreach; network devices send switch-related configuration changes, traffic information, network port status, etc. to network security monitoring devices Network security data; security equipment sends network security data such as the running status, security events, and configuration changes of horizontal isolation devices to network security monitoring devices; firewalls send plant firewall operating status, security events, policy changes and equipment to network security monitoring devices Abnormal and other network security data. After the network security monitoring device receives the above-mentioned network security data, it performs simple processing on the above-mentioned network security data, and sends the processed network security data to the network security monitoring platform, and the network security monitoring platform performs further processing on the above-mentioned processed network security data. Local security analysis (for example, security analysis of host key file changes, user authority changes, dangerous operations and other events), and when the analysis shows that there is a security event, security early warning (including host equipment illegal network outreach alarm, vertical encryption) , isolation, access that does not comply with security policies intercepted by firewall devices, CPU utilization limit alarm, illegal device access alarm, peripheral device configuration alarm, user abnormal operation alarm, etc.).

From the description of the existing network security management system, it can be seen that the method of packet capture mechanism (that is, the method of installing the monitoring system client program on each protected device) is used in the collection of network security data. This method exists The following two problems are: one is passively accepting the network security data sent by the protected device, lacking the initiative of monitoring, and installing the monitoring system client program on the protected device will cause additional burden on the protected device, and the protected device will be upgraded and maintained. Inconvenience and poor security; second, the data analysis efficiency is low (usually a pattern matching algorithm or a fast pattern matching algorithm is used, and the matching of characteristic strings is very time-consuming). In addition, during the security analysis, the abnormal traffic was not considered, and the false alarm rate was high; in addition, only security warning was carried out in the whole process, and effective security protection could not be realized.

To sum up, the existing network security protection methods have technical problems of passive acceptance, high false positive rate and lack of security protection.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present invention is to provide a network security protection method, device and electronic device to alleviate the technical problems of passive acceptance, high false positive rate and lack of security protection in the existing network security protection method.

In a first aspect, an embodiment of the present invention provides a network security protection method, which is applied to a network security protection device, including:

sending a data collection request to the protected device, wherein the data collection request carries information about the network security data to be collected;

Receive data response information returned by the protected device according to the data collection request, wherein the data response information includes: network security data and response status information collected by the protected device, and the network security data includes: traffic data and security event data;

Carrying out comparative analysis on the traffic data and the security event data with the standard information to obtain a comparative analysis result;

When the comparative analysis result shows that there is an abnormal event, the communication of the abnormal event is blocked, wherein the abnormal event includes at least: network violation outreach event and illegal device access event.

With reference to the first aspect, an embodiment of the present invention provides a first possible implementation manner of the first aspect, wherein, before sending the data collection request to the protected device, the method further includes:

A communication connection with the protected device is established.

In conjunction with the first aspect, an embodiment of the present invention provides a second possible implementation manner of the first aspect, wherein establishing a communication connection with the protected device includes:

sending a connection establishment request to the protected device;

Receive connection response information returned by the protected device according to the connection establishment request.

In conjunction with the first aspect, the embodiment of the present invention provides a third possible implementation manner of the first aspect, wherein the comparative analysis is performed on the traffic data and the security event data and the standard information, and the comparative analysis result obtained includes:

Extracting traffic data samples from the traffic data and the security event data by using a statistical analysis method;

comparing the flow data sample with the standard flow information in the standard information;

If the flow data sample matches the standard flow information, it is determined that there is no abnormal event;

If the flow data samples do not match the standard flow information, it is determined that an abnormal event exists.

In conjunction with the first aspect, the embodiment of the present invention provides a fourth possible implementation manner of the first aspect, wherein the comparative analysis is performed on the traffic data and the security event data and the standard information, and the comparative analysis result obtained includes:

Extract MAC address information and/or IP address information from the traffic data and the security event data by using a statistical analysis method;

Compare the MAC address information and/or IP address information with the whitelist information in the standard information, wherein the whitelist information includes: standard MAC address information and standard IP address information;

If the MAC address information and/or the IP address information matches the whitelist information, it is determined that there is no abnormal event;

If the MAC address information and/or IP address information does not match the whitelist information, it is determined that there is an abnormal event.

In conjunction with the first aspect, the embodiment of the present invention provides a fifth possible implementation manner of the first aspect, wherein blocking the communication of the abnormal event includes:

Determine the abnormal behavior device according to the network security data corresponding to the abnormal event;

Block the abnormal behavior device.

With reference to the first aspect, the embodiment of the present invention provides a sixth possible implementation manner of the first aspect, wherein the blocking of the abnormal behavior device includes:

Send the RST flag data packet to the target device, so that the target device closes the target communication link according to the RST flag data packet, wherein the target device is a device that communicates with the abnormal behavior device, and the target communication The link is a communication link that communicates with the abnormal behavior device;

or,

Sending the information of closing the port corresponding to the abnormal behavior device to the switch in the protected device, so that the switch cuts off the communication link with the abnormal behavior device.

In a second aspect, an embodiment of the present invention further provides a network security protection device, including:

a sending module, configured to send a data collection request to the protected device, wherein the data collection request carries information about the network security data to be collected;

a receiving module, configured to receive data response information returned by the protected device according to the data collection request, wherein the data response information includes: network security data and response status information collected by the protected device, the network Security data includes: traffic data and security event data;

a comparative analysis module, configured to carry out comparative analysis on the traffic data and the security event data and standard information to obtain a comparative analysis result;

An exception handling module, configured to block the communication of the abnormal event when the comparative analysis result is that there is an abnormal event, wherein the abnormal event includes at least: network violation outreach event, illegal device access event .

In conjunction with the second aspect, the embodiment of the present invention provides a first possible implementation manner of the second aspect, wherein the apparatus further includes:

A connection establishment module is used to establish a communication connection with the protected device.

In a third aspect, an embodiment of the present invention provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, when the processor executes the computer program Implement the steps of the method according to any one of the above first aspects.

The embodiments of the present invention have brought the following beneficial effects:

In the embodiment of the present invention, the network security protection device can actively send a data collection request to the protected device, and then receive the data response information returned by the protected device according to the data collection request; and then compare the traffic data and security event data with the standard information. A comparative analysis is performed to obtain a comparative analysis result; and when the comparative analysis result is an abnormal event, the communication of the abnormal event is blocked. It can be seen from the above description that, in the real-time example of the present invention, the network security protection device can actively send a data collection request to the protected device, that is, it can actively perform data collection without requiring additional security procedures on the protected device, which reduces the In addition, the returned data response information contains traffic data, that is, it can monitor abnormal traffic, which improves the monitoring accuracy. At the same time, when it is determined that there is an abnormal event, the communication of the abnormal event can be blocked. It alleviates the technical problems that the existing network security protection method can only passively accept data, the false positive rate is high and the lack of security protection.

Other features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the description, claims and drawings.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to illustrate the specific embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the specific embodiments or the prior art. Obviously, the accompanying drawings in the following description The drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

1 is a schematic structural diagram of a network security management system provided by an embodiment of the present invention;

2 is a flowchart of a network security protection method provided by an embodiment of the present invention;

3 is a flow chart of comparative analysis of traffic data and security event data and standard information provided by an embodiment of the present invention;

FIG. 4 is another flowchart of comparative analysis of traffic data and security event data and standard information provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of a network security protection device according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. example. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Example 1:

According to an embodiment of the present invention, an embodiment of a network security protection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawing may be executed in a computer system such as a set of computer-executable instructions, and, Although a logical order is shown in the flowcharts, in some cases steps shown or described may be performed in an order different from that herein.

FIG. 2 is a flowchart of a network security protection method according to an embodiment of the present invention. As shown in FIG. 2 , the method includes the following steps:

Step S202, sending a data collection request to the protected device, wherein the data collection request carries information about the network security data to be collected;

In the embodiment of the present invention, the execution body of the network security protection method may be a network security protection device. An agent program is deployed in the network security protection device in advance. After the deployment is completed, the network security device can execute the network security protection of the present invention. steps of the method.

Specifically, the protected devices include: host devices, network devices, security devices, firewalls, switches, and network security monitoring devices, etc. The embodiments of the present invention do not specifically limit the above protected devices.

In addition, the network security protection device of the present invention can actively send a data collection request (sniffing) to the protected device, and the data collection request carries information about network security data to be collected, that is, information about which data needs to be collected.

It should be noted that when the network security protection device sends the data collection request to the protected device, it specifically sends the data collection request to the protected device corresponding to the preset IP address.

Step S204, receiving data response information returned by the protected device according to the data collection request, wherein the data response information includes: network security data and response status information collected by the protected device, and the network security data includes: traffic data and security event data;

Specifically, after receiving the data collection request, the protected device will return the data response information according to the data collection request, so that the data response information obtained by the network security protection device can further analyze the data response information.

Traffic data refers to data related to traffic, such as traffic usage data; security event data refers to data related to security events, such as configuration change data of switches, operating status data of horizontal isolation devices, and so on.

It should be noted that the network security data at least include: host name, program name, version number, time and serial number, etc.

Step S206, compare and analyze the traffic data and the security event data with the standard information to obtain a comparison and analysis result;

After obtaining the traffic data and the security event data, compare and analyze the traffic data and the security event data with the standard information. The specific comparison and analysis process will be described in detail below, and will not be repeated here.

Step S208, when the result of the comparison and analysis is that there is an abnormal event, the communication of the abnormal event is blocked, wherein the abnormal event includes at least: network violation external connection event and illegal device access event.

In the embodiment of the present invention, the network security protection device can actively send a data collection request to the protected device, and then receive the data response information returned by the protected device according to the data collection request; and then compare the traffic data and security event data with the standard information. A comparative analysis is performed to obtain a comparative analysis result; and when the comparative analysis result is an abnormal event, the communication of the abnormal event is blocked. It can be seen from the above description that, in the real-time example of the present invention, the network security protection device can actively send a data collection request to the protected device, that is, it can actively perform data collection without requiring additional security procedures on the protected device, which reduces the In addition, the returned data response information contains traffic data, that is, it can monitor abnormal traffic, which improves the monitoring accuracy. At the same time, when it is determined that there is an abnormal event, the communication of the abnormal event can be blocked. It alleviates the technical problems that the existing network security protection method can only passively accept data, the false positive rate is high and the lack of security protection.

In addition, before sending the data collection request to the protected device, the method further includes:

Establish a communication connection with the protected device.

Specifically, 1) send a connection establishment request to the protected device; 2) receive connection response information returned by the protected device according to the connection establishment request.

When a connection establishment request is sent, a list of monitoring items is obtained, and the data to be collected is determined according to the list of monitoring items. For example, the agent program in the network security protection device opens a TCP connection, and sends a connection establishment request to the protected device according to the preset IP address. After the protected device receives the connection establishment request, it returns the connection response information according to the connection establishment request, and the connection response The information includes: connection result information and a list of monitoring items. The list of monitoring items includes attributes such as key, delay, lastlogsize, and time. In this way, a communication connection with the protected device is established, and then the agent closes the TCP connection.

The above content briefly introduces the network security protection method of the present invention, and the specific content involved therein is described in detail below.

In an optional embodiment of the present invention, referring to FIG. 3 , in step S206, the traffic data and the security event data are compared and analyzed with the standard information, and the obtained comparison and analysis results include:

Step S301, using a statistical analysis method to extract traffic data samples from traffic data and security event data;

Traffic analysis can have a good detection effect on new network attack methods and network viruses, which can greatly reduce the possibility of missed reports due to ignorance of attack methods, find the source of attacks before serious damage occurs, and reduce network losses to the minimum.

Specifically, the quantity traffic is part of the data in the switch data provided by the switch. After the switch data is obtained, a statistical analysis method is used to extract the traffic data from the switch data (that is, the network security data of the present invention, which includes traffic data and security event data). sample.

Step S302, comparing the flow data sample with the standard flow information in the standard information;

Specifically, according to the distribution characteristics of the traffic data samples and the standard traffic information in the standard information, it is determined whether a traffic change has occurred. Commonly used network protocols are SMTP, FTP, ICMP and so on.

Step S303, if the flow data sample matches the standard flow information, it is determined that there is no abnormal event;

Step S304, if the flow data sample does not match the standard flow information, it is determined that there is an abnormal event.

The distance is explained below. For example, the value range of the standard traffic information is 0.5, and the value of the traffic data sample obtained by continuous monitoring exceeds 1, which is in line with the network traffic characteristics in the early stage of a virus, that is, abnormal traffic occurs and there are abnormal events; On the contrary, there is no abnormal event.

In another optional embodiment of the present invention, referring to FIG. 4 , in step S206, the traffic data and security event data are compared and analyzed with the standard information, and the comparison and analysis results obtained include:

Step S401, using a statistical analysis method to extract MAC address information and/or IP address information from traffic data and security event data;

Step S402, comparing the MAC address information and/or IP address information with the whitelist information in the standard information, wherein the whitelist information includes: standard MAC address information and standard IP address information;

Step S403, if the MAC address information and/or the IP address information matches the whitelist information, it is determined that there is no abnormal event;

Step S404, if the MAC address information and/or the IP address information does not match the whitelist information, it is determined that there is an abnormal event.

In an optional embodiment of the present invention, blocking the communication of the abnormal event includes:

(1) Determine the abnormal behavior device according to the network security data corresponding to the abnormal event;

For example, after it is determined that there is an abnormal event through traffic analysis, the traffic numbers of different IP addresses are filtered out according to the traffic data samples corresponding to the abnormal event, and the abnormal behavior device is determined according to the statistical analysis method and the IP address with large traffic The IP address of the traffic data sample corresponding to the abnormal event determines the abnormal behavior device;

For another example, if a MAC address is not in the whitelist, it is determined that there is an abnormal event, and the device corresponding to the MAC address is an abnormal behavior device.

(2) Block abnormal behavior devices.

Specifically, the RST flag data packet is sent to the target device, so that the target device closes the target communication link according to the RST flag data packet, wherein the target device is a device that communicates with the abnormal behavior device, and the target communication link is with the abnormal behavior device. the communication link through which the communication takes place;

For example, taking the TCP protocol as an example, for the communication blocking of abnormal events, a data packet with an RST flag can be sent to the target device, including the source address, destination address and port number of the device, and the target device receives the RST flag data. After the packet is received, it will be considered that the target communication peer is abnormal, and the communication link will be closed immediately.

or,

Send the information about the port corresponding to the device with abnormal behavior to be closed to the switch in the protected device, so that the switch cuts off the communication link with the device with abnormal behavior.

It can be seen from the above description that one of the above two methods is a method of link blocking and the other is a method of port disabling, and the present invention does not specifically limit the above implementation methods.

Based on the characteristics of the power monitoring system, the present invention develops a set of network security protection devices for the power monitoring system, which is deployed according to the three-layer logical architecture of self-perception, independent collection, distributed processing and unified management and control, and focuses on the active safety of user behavior. Monitoring, effectively sensing network violations, outreach and illegal device access, etc., is a high-level security protection method, which makes up an important part of the information network security of power enterprises.

Embodiment 2:

An embodiment of the present invention further provides a network security protection device, and the network security protection device is mainly used to execute the network security protection method provided by the above content of the embodiment of the present invention. The following describes the network security protection device provided by the embodiment of the present invention in detail. introduce.

FIG. 5 is a schematic diagram of a network security protection device according to an embodiment of the present invention. As shown in FIG. 5 , the network security protection device mainly includes a sending module 10, a receiving module 20, a comparative analysis module 30 and an exception processing module 40, wherein :

a sending module, configured to send a data collection request to the protected device, wherein the data collection request carries information about the network security data to be collected;

The receiving module is used for receiving the data response information returned by the protected device according to the data collection request, wherein the data response information includes: network security data and response status information collected by the protected device, and the network security data includes: traffic data and security event data ;

The comparative analysis module is used to compare and analyze the traffic data and security event data with the standard information, and obtain the comparative analysis results;

The exception handling module is used for blocking the communication of the abnormal event when the comparative analysis result is that there is an abnormal event, wherein the abnormal event includes at least: network violation external connection event and illegal device access event.

In the embodiment of the present invention, the network security protection device can actively send a data collection request to the protected device, and then receive the data response information returned by the protected device according to the data collection request; and then compare the traffic data and security event data with the standard information. A comparative analysis is performed to obtain a comparative analysis result; and when the comparative analysis result is an abnormal event, the communication of the abnormal event is blocked. It can be seen from the above description that, in the real-time example of the present invention, the network security protection device can actively send a data collection request to the protected device, that is, it can actively perform data collection without requiring additional security procedures on the protected device, which reduces the In addition, the returned data response information contains traffic data, that is, it can monitor abnormal traffic, which improves the monitoring accuracy. At the same time, when it is determined that there is an abnormal event, the communication of the abnormal event can be blocked. It alleviates the technical problems that the existing network security protection method can only passively accept data, the false positive rate is high and the lack of security protection.

Optionally, the apparatus further includes: a connection establishment module for establishing a communication connection with the protected device.

Optionally, the connection establishment module is further configured to: send a connection establishment request to the protected device; and receive connection response information returned by the protected device according to the connection establishment request.

Optionally, the comparative analysis module is also used to: extract flow data samples from the flow data and security event data by using statistical analysis methods; compare the flow data samples with the standard flow information in the standard information; If the information matches, it is determined that there is no abnormal event; if the traffic data sample does not match the standard traffic information, it is determined that there is an abnormal event.

Optionally, the comparative analysis module is also used to: extract MAC address information and/or IP address information from traffic data and security event data by using a statistical analysis method; The list information is compared, wherein the whitelist information includes: standard MAC address information and standard IP address information; if the MAC address information and/or IP address information matches the whitelist information, it is determined that there is no abnormal event; if the MAC address information And/or the IP address information does not match the whitelist information, it is determined that there is an abnormal event.

Optionally, the abnormality processing module is further configured to: determine the abnormal behavior device according to the network security data corresponding to the abnormal event; and block the abnormal behavior device.

Optionally, the abnormality processing module is also used for: sending the RST mark data packet to the target device, so that the target device closes the target communication link according to the RST mark data packet, wherein, the target device is the device that communicates with the abnormal behavior device, and the target device is The communication link is a communication link for communicating with the abnormal behavior device; or, sending the port information corresponding to the abnormal behavior device shut down to the switch in the protected device, so that the switch cuts off the communication link with the abnormal behavior device.

The implementation principle and technical effects of the device provided by the embodiment of the present invention are the same as those of the foregoing method embodiment. For brief description, for the parts not mentioned in the device embodiment, reference may be made to the corresponding content in the foregoing method embodiment.

In another embodiment of the present invention, a computer storage medium is also provided, on which a computer program is stored, and when the computer runs the computer program, the steps of the methods of the above method embodiments are executed.

In another embodiment of the present invention, a computer program is also provided, and the computer program can be stored in the cloud or on a local storage medium. When the computer program is run by a computer or a processor, it is used to execute the corresponding steps of the method in the embodiments of the present invention, and to implement the corresponding modules in the network security protection device according to the embodiments of the present invention.

In addition, in the description of the embodiments of the present invention, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it may be a fixed connection or a detachable connection , or integrally connected; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or the internal communication between the two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood in specific situations.

In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. The indicated orientation or positional relationship is based on the orientation or positional relationship shown in the accompanying drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the indicated device or element must have a specific orientation or a specific orientation. construction and operation, and therefore should not be construed as limiting the invention. Furthermore, the terms "first", "second", and "third" are used for descriptive purposes only and should not be construed to indicate or imply relative importance.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. The apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one analysis unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a non-volatile computer-readable storage medium executable by an analyzer. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present invention, and are used to illustrate the technical solutions of the present invention, but not to limit them. The protection scope of the present invention is not limited thereto, although referring to the foregoing The embodiment has been described in detail the present invention, and those of ordinary skill in the art should understand: any person skilled in the art who is familiar with the technical field of the present invention can still modify the technical solutions described in the foregoing embodiments within the technical scope disclosed by the present invention. Or can easily think of changes, or equivalently replace some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be covered in the present invention. within the scope of protection. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. A network security protection method, characterized in that, applied to a network security protection device, comprising: sending a data collection request to the protected device, wherein the data collection request carries information about the network security data to be collected; Receive data response information returned by the protected device according to the data collection request, wherein the data response information includes: network security data and response status information collected by the protected device, and the network security data includes: traffic data and security event data; Carrying out comparative analysis on the traffic data and the security event data with the standard information to obtain a comparative analysis result; When the comparative analysis result shows that there is an abnormal event, the communication of the abnormal event is blocked, wherein the abnormal event includes at least: network violation outreach event and illegal device access event. 2. The network security protection method according to claim 1, wherein before sending the data collection request to the protected device, the method further comprises: A communication connection with the protected device is established. 3. The network security protection method according to claim 2, wherein establishing a communication connection with the protected device comprises: sending a connection establishment request to the protected device; Receive connection response information returned by the protected device according to the connection establishment request. 4. The network security protection method according to claim 1, wherein the flow data and the security event data are compared and analyzed with standard information, and the comparison and analysis results obtained include: Extracting traffic data samples from the traffic data and the security event data by using a statistical analysis method; comparing the flow data sample with the standard flow information in the standard information; If the flow data sample matches the standard flow information, it is determined that there is no abnormal event; If the flow data samples do not match the standard flow information, it is determined that an abnormal event exists. 5. The network security protection method according to claim 1, wherein the flow data and the security event data are compared and analyzed with standard information, and the comparison and analysis results obtained include: Extract MAC address information and/or IP address information from the traffic data and the security event data by using a statistical analysis method; Compare the MAC address information and/or IP address information with the whitelist information in the standard information, wherein the whitelist information includes: standard MAC address information and standard IP address information; If the MAC address information and/or the IP address information matches the whitelist information, it is determined that there is no abnormal event; If the MAC address information and/or IP address information does not match the whitelist information, it is determined that there is an abnormal event. 6. The network security protection method according to claim 1, wherein blocking the communication of the abnormal event comprises: Determine the abnormal behavior device according to the network security data corresponding to the abnormal event; Block the abnormal behavior device. 7. The network security protection method according to claim 6, wherein blocking the abnormal behavior device comprises: Send the RST flag data packet to the target device, so that the target device closes the target communication link according to the RST flag data packet, wherein the target device is a device that communicates with the abnormal behavior device, and the target communication The link is a communication link that communicates with the abnormal behavior device; or, Sending the information of closing the port corresponding to the abnormal behavior device to the switch in the protected device, so that the switch cuts off the communication link with the abnormal behavior device. 8. A network security protection device, comprising: a sending module, configured to send a data collection request to the protected device, wherein the data collection request carries information about the network security data to be collected; a receiving module, configured to receive data response information returned by the protected device according to the data collection request, wherein the data response information includes: network security data and response status information collected by the protected device, the network Security data includes: traffic data and security event data; a comparative analysis module, configured to carry out comparative analysis on the traffic data and the security event data and standard information to obtain a comparative analysis result; An exception handling module, configured to block the communication of the abnormal event when the comparative analysis result is that there is an abnormal event, wherein the abnormal event includes at least: network violation outreach event, illegal device access event . 9. The network security protection device according to claim 8, wherein the device further comprises: A connection establishment module is used to establish a communication connection with the protected device. 10. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, when the processor executes the computer program The steps of implementing the method of any of the preceding claims 1 to 7.