CN109474478B - Method, device and system for monitoring transmission data abnormity - Google Patents
Method, device and system for monitoring transmission data abnormity Download PDFInfo
- Publication number
- CN109474478B CN109474478B CN201811532704.8A CN201811532704A CN109474478B CN 109474478 B CN109474478 B CN 109474478B CN 201811532704 A CN201811532704 A CN 201811532704A CN 109474478 B CN109474478 B CN 109474478B
- Authority
- CN
- China
- Prior art keywords
- rate
- warning
- information
- sending
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
- H04L43/0894—Packet rate
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Environmental & Geological Engineering (AREA)
- Alarm Systems (AREA)
- Telephonic Communication Services (AREA)
Abstract
The embodiment of the application discloses a method, a device and a system for monitoring transmission data abnormity. One embodiment of the system comprises: the system comprises a low-security host, a first warning device, a high-security host, a second warning device and a gateway device. The low-security host sends data to the high-security host through the gatekeeper equipment, and determines the sending rate of the sent data; in response to the fact that the sending rate is smaller than a preset first rate upper limit threshold and larger than a preset first rate lower limit threshold, generating warning information and sending the warning information to first warning equipment; the high-security host receives data from the low-security host and determines the receiving rate of the received data; and generating warning information and sending the warning information to second warning equipment in response to the fact that the receiving rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold. The embodiment is helpful for technicians to find problems generated in the data transmission process in time, so that the safety of data transmission by using the gatekeeper is improved.
Description
Technical Field
The embodiment of the application relates to the technical field of computers, in particular to a method, a device and a system for monitoring transmission data abnormity.
Background
Internet applications are becoming more and more popular and more traditional modes of operation are migrating to the internet. Each government organization, enterprise and public institution also establishes its own portal or performs virtual network social management work. Many units and government agencies have extremely high requirements on network security, and the traditional methods such as firewall and intrusion detection are not enough to meet the requirements. The safety isolation and information exchange system, namely the network gate, is a new generation of enterprise-level information safety protection equipment with high safety degree, and provides higher-level safety protection capability for an information network by relying on a safety isolation technology, so that the anti-attack capability of the information network is greatly enhanced, and the occurrence of information leakage events is effectively prevented.
In the process of outputting data from a low-security level to a high-security level, the existing network gate equipment in the market has large continuous data volume and long time, is in an unattended state, and cannot be known in time by managers when the data output is abnormal, so that the data is accumulated or lost after a plurality of days or longer, a large amount of data needs to be retransmitted, and the wastes of time cost, labor cost and the like are caused.
Disclosure of Invention
An object of the embodiments of the present application is to provide an improved method, apparatus and system for monitoring transmission data anomaly, so as to solve the technical problems mentioned in the above background section.
In a first aspect, an embodiment of the present application provides a method for monitoring data transmission anomalies, where the method includes: in response to determining that a process of sending data to a high-security level host through a gatekeeper device is in an open state, determining a sending rate of sending the data; and generating warning information in response to the fact that the sending rate is smaller than a preset first rate upper limit threshold and larger than a preset first rate lower limit threshold, and sending the warning information to first warning equipment.
In some embodiments, the method further comprises: and generating prompt information in response to determining that the sending rate is greater than or equal to the first rate upper limit threshold, and sending the prompt information to the first warning device.
In some embodiments, the method further comprises: in response to determining that the sending rate is less than or equal to the first lower threshold rate, generating fault information and sending the fault information to the first warning device.
In a second aspect, an embodiment of the present application provides a method for monitoring received data for anomalies, where the method includes: in response to determining that a process receiving data from a low-security level host through a gatekeeper device is in an on state, determining a receive rate at which the data is received; and generating warning information in response to the fact that the receiving rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold, and sending the warning information to second warning equipment.
In some embodiments, the method further comprises: and generating prompt information in response to the fact that the receiving rate is larger than or equal to the second upper rate limit threshold, and sending the prompt information to the second warning device.
In some embodiments, the method further comprises: and generating fault information in response to determining that the receiving rate is less than or equal to the second lower rate limit threshold, and sending the fault information to the second warning device.
In a third aspect, an embodiment of the present application provides a method for generating an alarm signal, where the method includes: generating a preset warning signal corresponding to the warning information in response to receiving the warning information; responding to the received prompt information, and generating a preset prompt signal corresponding to the prompt information; and generating a preset fault signal corresponding to the fault information in response to receiving the fault information.
In some embodiments, the generating a preset warning signal corresponding to the warning information includes: and sending preset terminal warning information corresponding to the warning information to a terminal used by a target user.
In some embodiments, the generating a preset fault signal corresponding to the fault information includes: and sending preset terminal fault information corresponding to the fault information to a terminal used by a target user.
In a fourth aspect, an embodiment of the present application provides a gatekeeper data monitoring system, including: the system comprises a low-security host, a first warning device, a high-security host, a second warning device and a gateway device, wherein the low-security host is in communication connection with the first warning device, the high-security host is in communication connection with the second warning device, and the gateway device is in communication connection with the low-security host and the high-security host respectively; the low-security host configured to perform a method as described in any of the embodiments of the first aspect above; the high-security level host configured to perform the method as described in any of the embodiments of the second aspect above; the first warning device and the second warning device are each adapted to perform a method as described in any of the embodiments of the third aspect above.
In a fifth aspect, an embodiment of the present application provides an apparatus for monitoring an abnormality of transmitted data, where the apparatus includes: the device comprises a sending rate determining unit and a sending rate determining unit, wherein the sending rate determining unit is configured to determine a sending rate of data in response to the fact that a process of sending the data to a high-security host through a gateway device is in an open state; and the warning information generating unit is used for responding to the determination that the sending rate is smaller than a preset first rate upper limit threshold and larger than a preset first rate lower limit threshold, generating warning information and sending the warning information to the first warning device.
In a sixth aspect, an embodiment of the present application provides an apparatus for monitoring received data anomaly, where the apparatus includes: the receiving rate determining unit is configured to respond to the fact that the process of the data received by the gateway equipment and coming from the low-security level host computer is in an opening state, and determine the receiving rate of the data; and the warning information generating unit is used for generating warning information in response to the fact that the receiving rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold, and sending the warning information to second warning equipment.
In a seventh aspect, an embodiment of the present application provides an apparatus for generating an alarm signal, where the apparatus includes: a warning signal generating unit configured to generate a preset warning signal corresponding to warning information in response to receiving the warning information; the prompt signal generating unit is configured to respond to the received prompt information and generate a preset prompt signal corresponding to the prompt information; and the fault signal generating unit is used for responding to the received fault information and generating a preset fault signal corresponding to the fault information.
In an eighth aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the method as described in any implementation manner of the first, second, third, and third aspects.
According to the method, the device and the system for monitoring the transmission data abnormity, the low-security host monitors the sending rate of data, the high-security host monitors the receiving rate of the data, the gatekeeper provides data transmission between the low-security host and the high-security host, and the first warning device and the second warning device generate corresponding signals according to the received information respectively. Therefore, the state of the data transmission of the low-security host and the security host included in the gatekeeper data monitoring system can be monitored in real time, so that technicians can find problems generated in the data transmission process in time, and the security of data transmission by using the gatekeeper is further improved.
Drawings
Other features, objects and advantages of the present application will become more apparent upon reading of the following detailed description of non-limiting embodiments thereof, made with reference to the accompanying drawings in which:
FIG. 1 is an exemplary system architecture diagram of a gatekeeper data monitoring system of the present application;
FIG. 2 is a flow diagram of one embodiment of a method for monitoring for anomalies in transmitted data, according to the present application;
FIG. 3 is a flow diagram of one embodiment of a method for monitoring for anomalies in transmitted data, in accordance with the present application;
FIG. 4 is a flow diagram of one embodiment of a method for generating an alert signal according to the present application;
FIG. 5 is a schematic block diagram illustrating one embodiment of an apparatus for monitoring for anomalies in transmitted data in accordance with the present application;
FIG. 6 is a schematic block diagram illustrating one embodiment of an apparatus for monitoring for anomalies in transmitted data in accordance with the present application;
FIG. 7 is a schematic block diagram illustrating one embodiment of an apparatus for monitoring for anomalies in transmitted data in accordance with the present application;
FIG. 8 is a block diagram of a computer system suitable for use in implementing the electronic device of an embodiment of the present application.
Detailed Description
The present application will be described in further detail with reference to the following drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant invention and not restrictive of the invention. It should be noted that, for convenience of description, only the portions related to the related invention are shown in the drawings.
It should be noted that the embodiments and features of the embodiments in the present application may be combined with each other without conflict. The present application will be described in detail below with reference to the embodiments with reference to the attached drawings.
Fig. 1 illustrates an exemplary system architecture 100 to which the gatekeeper data monitoring system of the present embodiment may be applied.
As shown in fig. 1, system architecture 100 may include a low-security host 101, a network 102, a high-security host 103, a first warning device 104, a second warning device 105, and a gatekeeper device 106. Network 102 is used to provide a medium for communication links between low-security host 101 and high-security host 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.
In general, the low-security host 101 may receive data sent from the public network or the low-security network, save and backup the data to the local cache, and then transmit the data to the high-security host 103 through the gatekeeper device 106. The high-security host 103 receives the data transmitted from the gatekeeper device 106, and then the high-security host 103 transmits the data to the high-security gateway.
Low-security host 101 and high-security host 103 may be a variety of electronic devices including, but not limited to, desktop computers, laptop portable computers, and the like.
It should be noted that the method for monitoring the transmission data anomaly provided by the embodiment of the present application is generally executed by the low-security level host 101, and accordingly, the apparatus for monitoring the transmission data anomaly is generally disposed in the low-security level host 101. The method for monitoring received data for anomalies provided by the embodiment of the present application is generally performed by the high-security level host 103, and accordingly, the apparatus for monitoring received data for anomalies is generally disposed in the high-security level host 103. The method for generating an alarm signal provided by the embodiment of the present application is generally performed by the first warning device 104 and the second warning device 105, and accordingly, the apparatus for generating an alarm signal is generally disposed in the first warning device 104 and the second warning device 105.
It should be understood that the numbers of low-security level hosts 101, network 102, high-security level hosts 103, first warning devices 104, second warning devices 105, and gatekeeper devices 106 in fig. 1 are merely illustrative. There may be any number of low-security level hosts 101, networks 102, high-security level hosts 103, first warning devices 104, second warning devices 105, and gatekeeper devices 106, as desired for an implementation.
With continued reference to FIG. 2, a flow 200 of one embodiment of a method for monitoring for anomalies in transmitted data is shown, in accordance with the present application. The method comprises the following steps:
In this embodiment, an executing entity (e.g., the low-security level host 101 shown in fig. 1) of the method for monitoring the abnormality of the sent data may determine the sending rate of the sent data in response to determining that a process for sending data to a high-security level host (e.g., the high-security level host 103 shown in fig. 1) through a gatekeeper device (e.g., the gatekeeper device 106 shown in fig. 1) is in an on state. The network gate equipment is network safety equipment which is used for cutting off link layer connection between networks on a circuit by special hardware with various control functions and can exchange application data with proper safety between the networks. Generally, the gatekeeper device applied in the embodiment of the present application is a unidirectional transmission gatekeeper device, that is, data is transmitted from a low-security-level host to a high-security-level host.
The process may be a state in which an application program for controlling data transmission from the low-security host to the high-security host is running, and typically, when the process is started, the gatekeeper device connects (for example, through an instruction for controlling connection or disconnection transmitted by the low-security host) the network connection between the low-security host and the high-security host. The low-security host starts to send data to the high-security host through the gatekeeper device.
In the state that the process is started, the execution main body can monitor the sending rate of the sending data in real time. The method for monitoring the transmission rate is a common technical means in the field and is not described in detail here.
In this embodiment, the execution subject may generate warning information and transmit the warning information to a first warning device (e.g., the first warning device 104 shown in fig. 1) in response to determining that the transmission rate is less than a preset first upper rate threshold and greater than a preset first lower rate threshold.
The first upper threshold rate and the first lower threshold rate may be preset rate values. As an example, the first upper rate threshold may be 50MB/s and the first lower rate threshold may be 0 MB/s. The warning information is used for representing that the sending rate of the data is low and abnormality can occur. The warning information may include, but is not limited to, at least one of the following forms of information: numbers, text, levels, etc.
In some optional implementations of this embodiment, the executing body may generate a prompt message in response to determining that the sending rate is greater than or equal to the first upper threshold, and send the prompt message to the first warning device. The prompt information is used for representing that the sending rate of the data is large and the data transmission is normal. The reminder information may include, but is not limited to, at least one of the following forms of information: numbers, text, levels, etc.
In some optional implementations of this embodiment, the executing body may generate the fault information in response to determining that the sending rate is less than or equal to the first lower threshold rate, and send the fault information to the first warning device. The fault information is used for representing that the sending rate of the data is too low, and the data transmission has faults such as blockage, interruption and the like. The fault information may include, but is not limited to, information in at least one of the following forms: numbers, text, levels, etc. Typically, the first rate lower threshold may be set to 0 MB/s.
Generally, the first warning device may output a corresponding signal, such as a light, a sound, an image, etc., when receiving the warning message, the prompt message, and the failure message.
In the method provided by the above embodiment of the present application, by determining the sending rate of the sending data, if the sending rate is smaller than the preset first upper threshold and larger than the preset first lower threshold, the warning information is generated, and the warning information is sent to the first warning device. Therefore, the rate of sending data to the high-security host through the gatekeeper is monitored in real time, and the generated warning information is helpful for enabling technical personnel to know the state of data transmission in time, and is helpful for improving the safety of data transmission.
With continued reference to FIG. 3, a flow 300 of one embodiment of a method for monitoring for anomalies in transmitted data is shown, in accordance with the present application. The method comprises the following steps:
In this embodiment, an executing entity (e.g., the high-security level host 103 shown in fig. 1) of the method for monitoring the received data anomaly may determine a receiving rate of the received data in response to determining that a process of the data received from a low-security level host (e.g., the low-security level host 101 shown in fig. 1) through a gatekeeper device (e.g., the gatekeeper device 106 shown in fig. 1) is in an on state. The received data in this embodiment is the data sent through the gatekeeper device in the embodiment corresponding to fig. 2.
The process may be a state of controlling an application program receiving data transmitted from the low-security host computer while the application program is running. In the state that the process is started, the execution main body can monitor the receiving rate of the received data in real time. The method for monitoring the receiving rate is a common technical means in the field and is not described in detail here.
In this embodiment, the execution subject may generate warning information in response to determining that the reception rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold, and send the warning information to a second warning device (for example, the second warning device 105 shown in fig. 1). In this embodiment, the second upper threshold speed value and the second lower threshold speed value may be the same as or different from the first upper threshold speed value and the first lower threshold speed value in the embodiment corresponding to fig. 2.
As an example, the second upper rate threshold may be 50MB/s and the second lower rate threshold may be 0 MB/s. The warning information is used for representing that the receiving rate of the data is low and abnormality can occur. The warning information may include, but is not limited to, at least one of the following forms of information: numbers, text, levels, etc.
In some optional implementations of this embodiment, in response to determining that the reception rate is greater than or equal to the second upper rate threshold, a prompt is generated and sent to the second warning device. The prompt information is used for representing that the receiving rate of the data is large and the data transmission is normal. The reminder information may include, but is not limited to, at least one of the following forms of information: numbers, text, levels, etc.
In some optional implementations of this embodiment, in response to determining that the reception rate is less than or equal to the second lower threshold rate, generating fault information and sending the fault information to the second warning device. The fault information is used for representing that the receiving rate of the data is too low, and the data transmission has faults such as blockage, interruption and the like. The fault information may include, but is not limited to, information in at least one of the following forms: numbers, text, levels, etc. Typically, the first rate lower threshold may be set to 0 MB/s.
In the method provided by the above embodiment of the present application, by determining the receiving rate of the received data, if the receiving rate is smaller than the preset second upper rate threshold and larger than the preset second lower rate threshold, generating the warning information, and sending the warning information to the second warning device. Therefore, the speed of receiving the data sent by the low-security host through the gateway equipment is monitored in real time, and the generated warning information is helpful for enabling technical personnel to know the data transmission state in time, and is helpful for improving the safety of data transmission.
With continued reference to FIG. 4, a flow 400 of one embodiment of a method for generating an alert signal according to the present application is shown. The method comprises the following steps:
In the present embodiment, an execution subject of the method for generating an alarm signal (e.g., the first warning device or the second warning device shown in fig. 1) may generate a preset warning signal corresponding to warning information in response to receiving the warning information.
The warning signal can be used for prompting a technician that the data transmission rate is low, so that the technician can know the current data transmission condition in time.
The warning signal may be a signal of various forms, including but not limited to at least one of: lights, sounds, images, etc. As an example, the execution body may include a signal lamp, and when the warning message is received, the execution body controls the signal lamp to emit light of a first preset color (e.g., yellow). As another example, the execution main body may further include a sound output device (e.g., a sound box, a buzzer, etc.), and when the warning message is received, the execution main body controls the sound output device to emit a corresponding warning sound.
In some optional implementation manners of this embodiment, the execution main body may further send, in response to receiving the warning information, preset terminal-use warning information corresponding to the warning information to the terminal used by the target user. The target user may be a user who is to receive terminal warning information through a terminal used by the target user, for example, a user who manages a system characterized by the system architecture shown in fig. 1. The terminal used by the target user may establish a communication connection (including a wired connection method using a cable, an optical cable, or the like, or a wireless connection method using a bluetooth or GSM (Global System For Mobile Communications) connection, or the like) with the execution main body in advance, so that the terminal can receive information transmitted by the execution main body. The terminal used by the target user may include, but is not limited to, at least one of the following: cell-phone, panel computer, notebook computer, desktop computer etc..
The terminal warning information may be various forms of information such as letters, numbers, symbols, pictures, and the like.
As an example, the execution main body is connected to a terminal used by the target user through a GSM communication method, and when the execution main body receives the warning message, the execution main body sends a terminal warning message (for example, a text message "please note that the current data transmission rate is low!) to the terminal of the target user.
In the present embodiment, the execution body may generate the terminal warning information before, after, or simultaneously with the generation of the warning signal, and transmit the generated terminal warning information to the terminal used by the target user.
In this embodiment, the executing body may generate a preset prompt signal corresponding to the prompt message in response to receiving the prompt message.
The prompt signal can be used for prompting a technician that the data transmission rate is high, namely the transmission is normal, so that the technician can timely know the current data transmission condition.
The cue signal may be a signal in various forms including, but not limited to, at least one of: lights, sounds, images, etc. As an example, the execution body may include a signal lamp, and when the prompt message is received, the execution body controls the signal lamp to emit light of a second preset color (e.g., green). As another example, the execution main body may further include a sound output device (e.g., a sound box, a buzzer, etc.), and when the prompt information is received, the execution main body controls the sound output device to emit a corresponding prompt sound.
And step 403, responding to the received fault information, and generating a preset fault signal corresponding to the fault information.
In this embodiment, the execution subject may generate a preset fault signal corresponding to the fault information in response to receiving the fault information.
The fault signal can be used for prompting that the data transmission rate of a technician is too low, namely, the transmission fault is generated, so that the technician can know the current data transmission condition in time.
The fault signal may be a signal of various forms including, but not limited to, at least one of: lights, sounds, images, etc. As an example, the execution body may include a signal lamp, and when the fault information is received, the execution body controls the signal lamp to emit light of a third preset color (e.g., red). As another example, the execution main body may further include a sound output device (e.g., a sound box, a buzzer, etc.), and when the prompt information is received, the execution main body controls the sound output device to emit a corresponding prompt sound.
In some optional implementation manners of this embodiment, the execution main body may further send, in response to receiving the fault information, preset fault information for the terminal, which corresponds to the fault information, to the terminal used by the target user. The target user may be a user who is to receive the terminal failure information through the terminal used by the target user, for example, a user who manages a system characterized by the system architecture shown in fig. 1. For the description of the terminal used by the target user, reference may be made to the above alternative implementation, which is not described herein again.
The terminal malfunction information may be various forms of information such as letters, numbers, symbols, pictures, and the like.
As an example, the execution main body is connected to a terminal used by the target user through a GSM communication method, and when the execution main body receives the failure information, the execution main body sends the failure information for the terminal (for example, a text message "please note that the current data transmission has failed |) to the terminal of the target user.
In this embodiment, the execution body may generate a terminal fault signal before, after, or simultaneously with the generation of the fault signal, and transmit the generated terminal fault signal to the terminal used by the target user.
In the method provided by the above embodiment of the present application, a preset warning signal corresponding to the warning information is generated in response to receiving the warning information; responding to the received prompt information, and generating a preset prompt signal corresponding to the prompt information; and generating a preset fault signal corresponding to the fault information in response to receiving the fault information. Therefore, the corresponding signal is generated according to the data transmission rate detected by the low-security host or the high-security host, the current data transmission condition of a technician can be prompted in time, and the data transmission safety is improved.
In addition, this application has still provided a gatekeeper data monitoring system. Wherein, the gatekeeper data monitoring system is as shown in fig. 1, including: a low-security host 101, a first warning device 104, a high-security host 103, a second warning device 105, and a gatekeeper device 106. The low-security host computer is in communication connection with the first warning device, the high-security host computer is in communication connection with the second warning device, and the gatekeeper device is in communication connection with the low-security host computer and the high-security host computer respectively.
A low-security host configured to perform the method as described above with respect to the embodiment of fig. 2. A high-security level host configured to perform the method as described above with respect to the embodiment of fig. 3. The first warning device and the second warning device are each adapted to perform the method as described above for the corresponding embodiment of fig. 4.
In this embodiment, the steps respectively executed by the components included in the system may refer to the embodiments shown in fig. 2 to fig. 4, and are not described again here.
According to the system provided by the embodiment of the application, the low-security host monitors the sending rate of data, the high-security host monitors the receiving rate of data, the gatekeeper device provides data transmission between the low-security host and the high-security host, and the first warning device and the second warning device respectively generate corresponding signals according to the received information. Therefore, the state of the data transmission of the low-security host and the security host included in the gatekeeper data monitoring system can be monitored in real time, so that technicians can find problems generated in the data transmission process in time, and the security of data transmission by using the gatekeeper is further improved.
With further reference to fig. 5, as an implementation of the method described above for the embodiment shown in fig. 2, the present application provides an embodiment of an apparatus for monitoring transmission data anomaly, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 2, and the apparatus may be applied to various electronic devices.
As shown in fig. 5, the apparatus 500 for monitoring transmission data abnormality of the present embodiment includes: a sending rate determining unit 501, configured to determine a sending rate of sending data in response to determining that a process of sending data to the high-security level host through the gatekeeper is in an open state; a warning information generating unit 502 configured to generate warning information and transmit the warning information to the first warning device in response to determining that the transmission rate is less than a preset first rate upper threshold and greater than a preset first rate lower threshold.
In this embodiment, the sending rate determining unit 501 may determine the sending rate of the sending data in response to determining that a process of sending data to a high-security level host (e.g., the high-security level host 103 shown in fig. 1) through a gatekeeper device (e.g., the gatekeeper device 106 shown in fig. 1) is in an on state. The network gate equipment is network safety equipment which is used for cutting off link layer connection between networks on a circuit by special hardware with various control functions and can exchange application data with proper safety between the networks. Generally, the gatekeeper device applied in the embodiment of the present application is a unidirectional transmission gatekeeper device, that is, data is transmitted from a low-security-level host to a high-security-level host.
The process may be a state in which an application program for controlling data transmission from the low-security host to the high-security host is running, and typically, when the process is started, the gatekeeper device connects (for example, through an instruction for controlling connection or disconnection transmitted by the low-security host) the network connection between the low-security host and the high-security host. The low-security host starts to send data to the high-security host through the gatekeeper device.
In a state where the process is started, the transmission rate determining unit 501 may monitor a transmission rate of transmission data in real time. The method for monitoring the transmission rate is a common technical means in the field and is not described in detail here.
In this embodiment, the warning information generation unit 502 may generate warning information and transmit the warning information to a first warning device (e.g., the first warning device 104 shown in fig. 1) in response to determining that the transmission rate is less than a preset first rate upper threshold and greater than a preset first rate lower threshold.
The first upper threshold rate and the first lower threshold rate may be preset rate values. As an example, the first upper rate threshold may be 50MB/s and the first lower rate threshold may be 0 MB/s. The warning information is used for representing that the sending rate of the data is low and abnormality can occur. The warning information may include, but is not limited to, at least one of the following forms of information: numbers, text, levels, etc.
In some optional implementations of this embodiment, the apparatus 500 may further include: and a prompt information generation unit (not shown in the figure) configured to generate prompt information in response to a determination that the transmission rate is equal to or greater than the first rate upper limit threshold, and transmit the prompt information to the first warning device.
In some optional implementations of this embodiment, the apparatus 500 may further include: and a failure information generation unit (not shown in the figure) configured to generate failure information and transmit the failure information to the first warning device in response to a determination that the transmission rate is equal to or less than the first rate lower limit threshold.
The apparatus provided in the foregoing embodiment of the present application, determines a sending rate of sending data, generates warning information if the sending rate is less than a preset first upper threshold and greater than a preset first lower threshold, and sends the warning information to the first warning device. Therefore, the rate of sending data to the high-security host through the gatekeeper is monitored in real time, and the generated warning information is helpful for enabling technical personnel to know the state of data transmission in time, and is helpful for improving the safety of data transmission.
With further reference to fig. 6, as an implementation of the method described above for the embodiment shown in fig. 3, the present application provides an embodiment of an apparatus for monitoring transmission data anomaly, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 3, and the apparatus may be applied to various electronic devices.
As shown in fig. 6, the apparatus 600 for monitoring transmission data abnormality of the present embodiment includes: a receiving rate determining unit 601 configured to determine a receiving rate of the received data in response to determining that a process of the data received from the low-security-level host through the gatekeeper device is in an on state; and an alarm information generating unit 602 configured to generate alarm information and send the alarm information to the second alarm device in response to determining that the receiving rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold.
In this embodiment, the receiving rate determining unit 601 may determine the receiving rate of the received data in response to determining that a process of the data received from the low-security level host (e.g., the low-security level host 101 shown in fig. 1) through the gatekeeper device (e.g., the gatekeeper device 106 shown in fig. 1) is in an on state. The received data in this embodiment is the data sent through the gatekeeper device in the embodiment corresponding to fig. 2.
The process may be a state of controlling an application program receiving data transmitted from the low-security host computer while the application program is running. In the state where the process is started, the reception rate determining unit 601 may monitor the reception rate of the reception data in real time. The method for monitoring the receiving rate is a common technical means in the field and is not described in detail here.
In this embodiment, the warning information generation unit 602 may generate warning information and send the warning information to a second warning device (e.g., the second warning device 105 shown in fig. 1) in response to determining that the reception rate is less than a preset second upper rate threshold and greater than a preset second lower rate threshold. In this embodiment, the second upper threshold speed value and the second lower threshold speed value may be the same as or different from the first upper threshold speed value and the first lower threshold speed value in the embodiment corresponding to fig. 5.
As an example, the second upper rate threshold may be 50MB/s and the second lower rate threshold may be 0 MB/s. The warning information is used for representing that the receiving rate of the data is low and abnormality can occur. The warning information may include, but is not limited to, at least one of the following forms of information: numbers, text, levels, etc.
In some optional implementations of this embodiment, the apparatus 600 may further include: and a prompt information generation unit (not shown in the figure) configured to generate prompt information in response to a determination that the reception rate is equal to or greater than the second rate upper limit threshold, and to transmit the prompt information to the second warning device.
In some optional implementations of this embodiment, the apparatus 600 may further include: and a failure information generation unit (not shown in the figure) configured to generate failure information in response to a determination that the reception rate is equal to or less than the second rate lower limit threshold, and to transmit the failure information to the second warning device.
The apparatus provided in the foregoing embodiment of the present application, determines a receiving rate of the received data, generates the warning information if the receiving rate is less than a preset second upper rate threshold and greater than a preset second lower rate threshold, and sends the warning information to the second warning device. Therefore, the speed of receiving the data sent by the low-security host through the gateway equipment is monitored in real time, and the generated warning information is helpful for enabling technical personnel to know the data transmission state in time, and is helpful for improving the safety of data transmission.
With further reference to fig. 7, as an implementation of the method described above for the embodiment shown in fig. 4, the present application provides an embodiment of an apparatus for monitoring transmission data anomaly, where the embodiment of the apparatus corresponds to the embodiment of the method shown in fig. 7, and the apparatus may be applied to various electronic devices.
As shown in fig. 7, the apparatus 700 for monitoring transmission data abnormality of the present embodiment includes: a warning signal generating unit 701 configured to generate a preset warning signal corresponding to the warning information in response to receiving the warning information; a prompt signal generating unit 702 configured to generate a preset prompt signal corresponding to the prompt information in response to receiving the prompt information; the fault signal generating unit 703 is configured to generate a preset fault signal corresponding to the fault information in response to receiving the fault information.
In the present embodiment, the warning signal generation unit 701 may generate a preset warning signal corresponding to the warning information in response to receiving the warning information.
The warning signal can be used for prompting a technician that the data transmission rate is low, so that the technician can know the current data transmission condition in time.
The warning signal may be a signal of various forms, including but not limited to at least one of: lights, sounds, images, etc.
In this embodiment, the cue signal generating unit 702 may generate a preset cue signal corresponding to cue information in response to receiving the cue information.
The prompt signal can be used for prompting a technician that the data transmission rate is high, namely the transmission is normal, so that the technician can timely know the current data transmission condition.
The cue signal may be a signal in various forms including, but not limited to, at least one of: lights, sounds, images, etc.
In this embodiment, the fault signal generation unit 703 may generate a preset fault signal corresponding to the fault information in response to receiving the fault information.
The fault signal can be used for prompting that the data transmission rate of a technician is too low, namely, the transmission fault is generated, so that the technician can know the current data transmission condition in time.
The fault signal may be a signal of various forms including, but not limited to, at least one of: lights, sounds, images, etc.
In some optional implementations of this embodiment, the warning signal generating unit 701 may be further configured to: and sending preset terminal warning information corresponding to the warning information to the terminal used by the target user.
In some optional implementations of this embodiment, the fault signal generating unit 703 may be further configured to: and sending preset fault information for the terminal corresponding to the fault information to the terminal used by the target user.
The device provided by the above embodiment of the present application generates a preset warning signal corresponding to the warning information by responding to the received warning information; responding to the received prompt information, and generating a preset prompt signal corresponding to the prompt information; and generating a preset fault signal corresponding to the fault information in response to receiving the fault information. Therefore, the corresponding signal is generated according to the data transmission rate detected by the low-security host or the high-security host, the current data transmission condition of a technician can be prompted in time, and the data transmission safety is improved.
Referring now to FIG. 8, a block diagram of a computer system 800 suitable for implementing an electronic device (e.g., the low-security host, the high-security host, the first warning device, and the second warning device shown in FIG. 1) according to embodiments of the present application is shown. The electronic device shown in fig. 8 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present application.
As shown in fig. 8, the computer system 800 includes a Central Processing Unit (CPU)801 that can perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM)802 or a program loaded from a storage section 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data necessary for the operation of the system 800 are also stored. The CPU 801, ROM 802, and RAM 803 are connected to each other via a bus 804. An input/output (I/O) interface 805 is also connected to bus 804.
The following components are connected to the I/O interface 805: an input portion 806 including a keyboard, a mouse, and the like; an output section 807 including a display such as a Liquid Crystal Display (LCD) and a speaker; a storage portion 808 including a hard disk and the like; and a communication section 809 including a network interface card such as a LAN card, a modem, or the like. The communication section 809 performs communication processing via a network such as the internet. A drive 810 is also connected to the I/O interface 805 as necessary. A removable medium 811 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 810 as necessary, so that a computer program read out therefrom is mounted on the storage section 808 as necessary.
In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 809 and/or installed from the removable medium 811. The computer program performs the above-described functions defined in the method of the present application when executed by the Central Processing Unit (CPU) 801.
It should be noted that the computer readable storage medium described herein can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In this application, however, a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable storage medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations for aspects of the present application may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units described in the embodiments of the present application may be implemented by software or hardware. The described units may also be provided in a processor, and may be described as: a processor includes a transmission rate determination unit and a warning information generation unit. The names of these units do not constitute a limitation to the module itself in some cases, and for example, the transmission rate determining unit may also be described as a "unit that determines the transmission rate of transmission data in response to determining that a process of transmitting data to the high-security level host through the gatekeeper device is in an on state".
As another aspect, the present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or may exist separately without being assembled into the electronic device. The computer readable storage medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: in response to determining that a process of sending data to the high-security host through the gatekeeper is in an open state, determining a sending rate of the sent data; and generating warning information in response to determining that the sending rate is smaller than a preset first rate upper limit threshold and larger than a preset first rate lower limit threshold, and sending the warning information to the first warning device.
Additionally, the one or more programs, when executed by the electronic device, may further cause the electronic device to: in response to determining that a process of data from a low-security level host received through a gatekeeper device is in an on state, determining a reception rate of the received data; in response to determining that the receiving rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold, generating warning information and sending the warning information to a second warning device
Additionally, the one or more programs, when executed by the electronic device, may further cause the electronic device to: generating a preset warning signal corresponding to the warning information in response to receiving the warning information; responding to the received prompt information, and generating a preset prompt signal corresponding to the prompt information; and generating a preset fault signal corresponding to the fault information in response to receiving the fault information.
The above description is only a preferred embodiment of the application and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention herein disclosed is not limited to the particular combination of features described above, but also encompasses other arrangements formed by any combination of the above features or their equivalents without departing from the spirit of the invention. For example, the above features may be replaced with (but not limited to) features having similar functions disclosed in the present application.
Claims (10)
1. A method for monitoring data transmission abnormity is applied to a low-security host included in a gatekeeper data monitoring system, and is characterized by comprising the following steps:
in response to determining that a process of sending data to a high-security level host through a gatekeeper device is in an open state, determining a sending rate of sending the data;
and generating warning information in response to the fact that the sending rate is smaller than a preset first rate upper limit threshold and larger than a preset first rate lower limit threshold, and sending the warning information to first warning equipment.
2. The method of claim 1, further comprising:
and generating prompt information in response to determining that the sending rate is greater than or equal to the first rate upper limit threshold, and sending the prompt information to the first warning device.
3. The method according to claim 1 or 2, characterized in that the method further comprises:
in response to determining that the sending rate is less than or equal to the first lower threshold rate, generating fault information and sending the fault information to the first warning device.
4. A gatekeeper data monitoring system, the system comprising:
the system comprises a low-security host, a first warning device, a high-security host, a second warning device and a gateway device, wherein the low-security host is in communication connection with the first warning device, the high-security host is in communication connection with the second warning device, and the gateway device is in communication connection with the low-security host and the high-security host respectively;
the low-security host configured to perform the method of one of claims 1 to 3;
the high-security level host is configured to: in response to determining that a process receiving data from a low-security level host through a gatekeeper device is in an on state, determining a receive rate at which the data is received; in response to the fact that the receiving rate is smaller than a preset second upper rate threshold and larger than a preset second lower rate threshold, generating warning information and sending the warning information to second warning equipment;
the first warning device and the second warning device are respectively configured to: generating a preset warning signal corresponding to the warning information in response to receiving the warning information; responding to the received prompt information, and generating a preset prompt signal corresponding to the prompt information; and generating a preset fault signal corresponding to the fault information in response to receiving the fault information.
5. The system of claim 4, wherein the high-security level host is further configured to:
and generating prompt information in response to the fact that the receiving rate is larger than or equal to the second upper rate limit threshold, and sending the prompt information to the second warning device.
6. The system of claim 4 or 5, wherein the high-security level host is further configured to:
and generating fault information in response to determining that the receiving rate is less than or equal to the second lower rate limit threshold, and sending the fault information to the second warning device.
7. The system of claim 4, wherein the first warning device and the second warning device are further configured to:
and sending preset terminal warning information corresponding to the warning information to a terminal used by a target user.
8. The system of claim 4 or 7, wherein the first warning device and the second warning device are further configured to:
and sending preset terminal fault information corresponding to the fault information to a terminal used by a target user.
9. An apparatus for monitoring data transmission abnormality, the apparatus is applied to a low-security host included in a gatekeeper data monitoring system, and the apparatus comprises:
the device comprises a sending rate determining unit and a sending rate determining unit, wherein the sending rate determining unit is configured to determine a sending rate of data in response to the fact that a process of sending the data to a high-security host through a gateway device is in an open state;
and the warning information generating unit is used for responding to the determination that the sending rate is smaller than a preset first rate upper limit threshold and larger than a preset first rate lower limit threshold, generating warning information and sending the warning information to the first warning device.
10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-3.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811532704.8A CN109474478B (en) | 2018-12-14 | 2018-12-14 | Method, device and system for monitoring transmission data abnormity |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811532704.8A CN109474478B (en) | 2018-12-14 | 2018-12-14 | Method, device and system for monitoring transmission data abnormity |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109474478A CN109474478A (en) | 2019-03-15 |
| CN109474478B true CN109474478B (en) | 2022-04-29 |
Family
ID=65675199
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811532704.8A Active CN109474478B (en) | 2018-12-14 | 2018-12-14 | Method, device and system for monitoring transmission data abnormity |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109474478B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115277256B (en) * | 2022-09-27 | 2022-12-16 | 中国民用航空局空中交通管理局航空气象中心 | Early warning method and system for data intranet and extranet gateway transmission |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101127680A (en) * | 2007-07-20 | 2008-02-20 | 胡德勇 | Unidirectional physical separation network brake for USB optical fiber |
| CN101527647A (en) * | 2008-03-06 | 2009-09-09 | 原创信通电信技术(北京)有限公司 | Multi-data plane oriented resource management realization method |
| CN103023755A (en) * | 2012-12-07 | 2013-04-03 | 东莞宇龙通信科技有限公司 | Method and electronic device for data transmission |
| CN106982160A (en) * | 2017-03-10 | 2017-07-25 | 深圳市利谱信息技术有限公司 | Link asymmetry gateway Dual-Computer Hot-Standby System and main/standby switching method |
| CN108055144A (en) * | 2017-10-23 | 2018-05-18 | 北京迈特力德信息技术有限公司 | The monitoring method and system of a kind of network equipment |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN203482233U (en) * | 2013-03-28 | 2014-03-12 | 施国君 | Direct connection type unidirectional optical fiber physical isolation shutter |
| CN104219077A (en) * | 2013-06-04 | 2014-12-17 | 成都睿恒科技有限公司 | Information management system for middle and small-sized enterprises |
| CN204481853U (en) * | 2015-03-24 | 2015-07-15 | 安徽清新互联信息科技有限公司 | A kind of isolation gap based on SDI |
| US11044183B2 (en) * | 2015-12-29 | 2021-06-22 | Xilinx, Inc. | Network interface device |
-
2018
- 2018-12-14 CN CN201811532704.8A patent/CN109474478B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101127680A (en) * | 2007-07-20 | 2008-02-20 | 胡德勇 | Unidirectional physical separation network brake for USB optical fiber |
| CN101527647A (en) * | 2008-03-06 | 2009-09-09 | 原创信通电信技术(北京)有限公司 | Multi-data plane oriented resource management realization method |
| CN103023755A (en) * | 2012-12-07 | 2013-04-03 | 东莞宇龙通信科技有限公司 | Method and electronic device for data transmission |
| CN106982160A (en) * | 2017-03-10 | 2017-07-25 | 深圳市利谱信息技术有限公司 | Link asymmetry gateway Dual-Computer Hot-Standby System and main/standby switching method |
| CN108055144A (en) * | 2017-10-23 | 2018-05-18 | 北京迈特力德信息技术有限公司 | The monitoring method and system of a kind of network equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109474478A (en) | 2019-03-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9391860B2 (en) | Systems and methods for managing computing systems utilizing augmented reality | |
| US10938859B2 (en) | Managing privileged system access based on risk assessment | |
| US9584378B1 (en) | Computer-implemented command control in information technology service environment | |
| US10127093B1 (en) | Method and apparatus for monitoring a message transmission frequency in a robot operating system | |
| US10579807B2 (en) | Preventing image capture data leaks | |
| CN112615858B (en) | Internet of things equipment monitoring method, device and system | |
| US11395124B2 (en) | Artificial intelligence for emergency assistance | |
| CN107896172A (en) | Monitor fault handling method and device, storage medium and electronic equipment | |
| US10152197B1 (en) | Dynamic indication of a status of an application | |
| CN109784036B (en) | Anti-disclosure processing method and device for application program, medium and electronic equipment | |
| CN111368339B (en) | Electronic signature loading method and device | |
| CN109474478B (en) | Method, device and system for monitoring transmission data abnormity | |
| US20150067139A1 (en) | Agentless monitoring of computer systems | |
| US8786458B1 (en) | Browser-based alerting system | |
| WO2023213060A1 (en) | Management method and system based on zabbix monitoring platform | |
| CN112235244A (en) | Construction method of abnormal message, detection method, device and medium of industrial control network equipment | |
| CN114244700B (en) | Port processing method and device, electronic equipment and computer readable storage medium | |
| CN114679295B (en) | Firewall security configuration method and device | |
| CN114257632B (en) | Method and device for reconnecting broken wire, electronic equipment and readable storage medium | |
| CN112532603B (en) | Cross-domain file exchange leading-in device and method based on exchange authorization file | |
| US20170124060A1 (en) | Dynamic creation of change management templates | |
| US10621382B2 (en) | Monitoring leakage of corporation information for smart phone | |
| CN110262756B (en) | Method and device for caching data | |
| US20230067756A1 (en) | Using machine learning for security anomaly detection and user experience inference | |
| CN117675262A (en) | Media resource protection method and device based on zero trust and related equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |