CN116980221A - Traffic monitoring methods, devices, equipment and media based on cyberspace shooting range - Google Patents

Abstract

The present disclosure provides a traffic monitoring method, device, equipment and medium based on a cyberspace shooting range. The traffic monitoring method includes: obtaining network security events from the security event database of the cyberspace shooting range; obtaining characteristic data of network security events; based on the characteristic data, querying the traffic data corresponding to network security events in the traffic database of the cyberspace shooting range, where ,The traffic database stores the full traffic mirroring ,data of network security events that occur in the ,cyberspace range. The disclosed embodiments can ensure that the monitored data traffic is complete, thereby improving the accuracy of using data traffic to determine the status of traffic collection and storage devices. The disclosed embodiments can be applied to network security, communication security, etc.

Description

Traffic monitoring methods, devices, equipment and media based on cyberspace shooting range

Technical field

The present disclosure relates to the field of network security, and in particular to traffic monitoring methods, devices, equipment and media based on cyberspace shooting ranges.

Background technique

Traffic data is an important component for analyzing cybersecurity incidents that occur in cyberspace ranges. In order to ensure that the traffic can be collected correctly and completely, the traffic needs to be monitored to ensure that the traffic collection and storage devices are in normal condition.

In the existing technology, network traffic data is generally monitored by monitoring the traffic collection configuration status of the traffic collection equipment and traffic mirroring equipment in the cyberspace shooting range. However, due to the large number of nodes and complex topological relationships in the cyberspace range, even if some collection nodes fail or part of the upstream and downstream networks are blocked, the traffic collection equipment can still collect traffic data through non-failed nodes and unblocked network connections. Therefore, the traffic data monitored in this way may not be complete, and therefore cannot represent the normal status of the traffic collection and storage devices in the entire cyberspace range. Therefore, the traffic monitoring methods in the existing technology cannot accurately reflect whether there are abnormalities in the traffic collection and storage equipment in the cyberspace shooting range.

Contents of the invention

Embodiments of the present disclosure provide traffic monitoring methods, devices, equipment and media based on cyberspace shooting ranges, which can ensure that the monitored data traffic is complete, thereby improving the accuracy of using data traffic to determine the status of traffic collection and storage devices.

According to one aspect of the present disclosure, a traffic monitoring method based on a cyberspace range is provided, including:

Obtain network security events from the security event database of the cyberspace range;

Obtain characteristic data of the network security incident;

Based on the characteristic data, the traffic data corresponding to the network security event is queried in the traffic database of the cyberspace shooting range, where the traffic database stores all the occurrences of the network security event in the cyberspace shooting range. Traffic mirroring data.

According to one aspect of the present disclosure, a traffic monitoring device based on a cyberspace shooting range is provided, including:

A first acquisition unit configured to acquire network security events from the security event database of the cyberspace shooting range;

a second acquisition unit, configured to acquire characteristic data of the network security event;

A first query unit configured to query the traffic data corresponding to the network security event in the traffic database of the cyberspace shooting range based on the characteristic data, wherein the traffic database stores the network security event in the Full traffic mirrored data occurring in cyberspace ranges.

Optionally, the first acquisition unit is specifically used to:

Determine the monitoring cycle and monitoring duration;

According to the monitoring cycle, the monitoring time interval is determined according to the monitoring duration;

Randomly extract a predetermined number of the network security events that occur within the monitoring time interval from the security event database of the cyberspace shooting range.

Optionally, the characteristic data includes the source address, source port, destination address, destination port, virtual local area network identifier, and timestamp of the occurrence of the network security event.

Optionally, the traffic database includes multiple traffic interfaces, each of the traffic interfaces corresponding to one of the network security events; each of the traffic interfaces includes a traffic start time, a traffic end time, and a traffic parameter group, The traffic parameter group includes a traffic virtual LAN identifier, a traffic source address, a traffic source port, a traffic destination address, and a traffic destination port;

The first query unit is specifically used for:

Determine candidate traffic ports in the traffic database based on the traffic start time, traffic end time, and the timestamp;

Based on the matching relationship between the source address and the traffic source address, the matching relationship between the source port and the traffic source port, the matching relationship between the target address and the traffic target address, the target port and the The matching relationship between the traffic target port, the matching relationship between the virtual LAN identifier and the traffic virtual LAN identifier, and determining the target traffic port corresponding to the network security event among the candidate traffic ports;

The traffic data of the network security event is returned by the target traffic interface.

Optionally, the network security event includes an event identifier;

The feature data includes forward feature data and reverse feature data;

The second acquisition unit is specifically used for:

According to the event identifier, the source address, the source port, the target address, the target port, the virtual local area network identifier, and the time of the network security event are retrieved from the security event database. stamp;

Combining the source address, the source port, the target address, the target port, the virtual local area network identifier, and the timestamp into the forward feature data;

Use the target address as the reverse source address, the target port as the reverse source port, the source address as the reverse target address, and the source port as the reverse target port;

The reverse source address, the reverse source port, the reverse target address, the reverse target port, the virtual local area network identifier, and the timestamp are combined into the reverse feature data.

Optionally, the traffic data includes forward traffic data and reverse traffic data;

The first query unit is specifically used for:

Based on the source address, the source port, the target address, the target port, the virtual LAN identifier, and the timestamp in the forward feature data, the traffic database is determined Forward traffic data corresponding to network security events;

Based on the reverse source address, the reverse source port, the reverse target address, the reverse target port, the virtual LAN identifier, and the timestamp in the reverse feature data, in the traffic database Determine the reverse traffic data corresponding to the network security event.

Optionally, the second acquisition unit is specifically used to:

The characteristic data of the network security event is obtained from a fused security event index library in the security event database; the fused security event index library is generated based on a plurality of network security events in the security event database.

Optionally, the traffic database obtains the full traffic mirroring data of the network security event through the following process:

Insert traffic probes into each node of the cyberspace range;

When the network security event occurs, use the traffic probe to capture the traffic data;

If the traffic probe captures the traffic data at each node where the network security event occurs, the traffic data is mirrored and stored in the traffic database to obtain the full traffic mirroring data.

Optionally, the flow monitoring device also includes:

An alarm initiating unit is used to initiate an alarm event if the traffic data corresponding to the network security event is not queried;

The second query unit is configured to query the traffic data corresponding to the network security event in the traffic database again after a preset time interval based on the alarm event.

According to an aspect of the present disclosure, an electronic device is provided, including a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the flow monitoring method as described above is implemented.

According to an aspect of the present disclosure, a computer-readable storage medium is provided, the storage medium stores a computer program, and when the computer program is executed by a processor, the traffic monitoring method as described above is implemented.

According to an aspect of the present disclosure, a computer program product is provided. The computer program product includes a computer program that is read and executed by a processor of a computer device, so that the computer device performs the flow monitoring method as described above. .

In this disclosed embodiment, network security events are obtained from the security event database of the cyberspace shooting range, and then the characteristic data of the network security events are obtained. Based on the characteristic data, the traffic data generated when the network security event occurs is queried in the traffic database of the cyberspace shooting range. . The traffic database stores full-image traffic data when network security incidents occur. If some nodes in the traffic collection device are abnormal, the traffic data cannot be completely collected and cannot be mirrored and stored in the traffic database. Therefore, the traffic data queried in the traffic database based on the data characteristics of network security events must be the complete traffic data corresponding to network security events. If the traffic data generated when a network security incident occurs cannot be queried in the traffic database based on the characteristic data, it means that some nodes in the traffic collection and storage device in the cyberspace range have failed or a certain network connection is blocked, and it needs to be checked as soon as possible. repair. If the traffic data can be queried, it means that the status of the traffic collection and storage device is normal. Therefore, the embodiments of the present disclosure ensure that the monitored traffic data is complete, thereby improving the accuracy of using data traffic to determine the status of traffic collection and storage devices.

Additional features and advantages of the disclosure will be set forth in the description which follows, and, in part, will be apparent from the description, or may be learned by practice of the disclosure. The objectives and other advantages of the disclosure may be realized and obtained by the structure particularly pointed out in the written description, claims and appended drawings.

Description of the drawings

The drawings are used to provide a further understanding of the technical solution of the present disclosure, and constitute a part of the specification. They are used to explain the technical solution of the present disclosure together with the embodiments of the present disclosure, and do not constitute a limitation of the technical solution of the present disclosure.

Figure 1 is an architecture diagram of a traffic monitoring method based on a cyberspace shooting range provided by an embodiment of the present disclosure;

Figure 2 is a flow chart of a traffic monitoring method based on a cyberspace shooting range according to an embodiment of the present disclosure;

Figure 3 is a specific flow chart of step 210 in Figure 2;

Figure 4 is an example diagram for determining the monitoring event interval;

Figure 5 is a specific flow chart of step 230 in Figure 2;

Figure 6 is a specific flow chart of step 220 in Figure 2;

Figure 7 is a schematic diagram of the forward feature data and reverse feature data in Figure 6;

Figure 8 is a specific flow chart of step 230 in Figure 2;

Figure 9 is a specific flow chart for the traffic database to obtain full traffic mirror data;

Figure 10 is a specific flow chart if the traffic data is not queried after Figure 2;

Figure 11 is an overall flow chart of an embodiment of the present disclosure;

Figure 12 is a structural block diagram of a flow monitoring device according to an embodiment of the present disclosure;

Figure 13 is a control terminal structure diagram of the traffic monitoring method shown in Figure 2 according to an embodiment of the present disclosure;

Figure 14 is a server structure diagram of the traffic monitoring method shown in Figure 2 according to an embodiment of the present disclosure.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present disclosure more clear, the present disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present disclosure and are not intended to limit the present disclosure.

Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are explained. The nouns and terms involved in the embodiments of the present disclosure are applicable to the following explanations:

Cyberspace shooting range: The cyberspace shooting range is a technology or product based on virtualization technology that simulates and reproduces the network architecture, system equipment, business traffic operating status and operating environment in real open network space, so as to more effectively Realize network security-related learning and research, etc., thereby improving personnel's network security confrontation level and system defense capabilities. Through the analysis of network security events in the cyberspace shooting range, protection strategies are determined to improve the stability and security of the network in the real environment.

Traffic Mirroring: Traffic mirroring is a network technology used to copy network traffic to another interface (or multiple interfaces) in real time for analysis and monitoring. Traffic mirroring can help operation and maintenance personnel and security personnel monitor the stability and security of network equipment and applications in real time, and analyze traffic for problem troubleshooting and attack protection. At the same time, traffic mirroring will not affect network bandwidth and will not interfere with the normal operation of the network.

Data collection probe: A data collection probe refers to a device that captures and analyzes specified network traffic during network communication. In the capture phase, the probe captures the network traffic connected to it and stores the captured data in memory or hard disk. During the analysis phase, the probe decodes, reorganizes, and filters the captured data to extract useful information.

Figure 1 is a system architecture diagram to which the traffic monitoring method is applied according to an embodiment of the present disclosure. It includes: control terminal and cyberspace shooting range. The cyberspace shooting range includes security event database, traffic database and traffic collection equipment.

The control terminal is a device used to initiate operations such as monitoring the cyberspace shooting range, viewing monitoring results, and handling abnormal results when the monitoring results are abnormal. It includes desktop computers, laptop computers, PDAs (personal digital assistants), mobile phones, dedicated terminals and other forms. In addition, it can be a single device or a collection of multiple devices. For example, multiple devices are connected through a LAN and share a display device to work together to form a control terminal.

The cyberspace shooting range is a computer system where users conduct network security attack and defense drills. The cyberspace range can be a high-performance computer, a combination of a portion of multiple high-performance computers, etc. The security incident database in the cyberspace range is used to store all network security events that occur in the cyberspace range. The traffic collection device is used to collect traffic data when a network security incident occurs. After collecting the traffic data, the data image is stored in the traffic database.

When using a control terminal to monitor traffic at a cyberspace shooting range, it is necessary to use the network time protocol to synchronize the time of each computer in the network so that the traffic data of network security events can be accurately found.

According to an embodiment of the present disclosure, a traffic monitoring method based on a cyberspace shooting range is provided.

Traffic monitoring is used to monitor traffic data in cyberspace shooting ranges. When there is an abnormality in the monitored traffic data, the relevant person in charge can detect and repair it immediately to ensure that the cyberspace shooting range can accurately collect traffic data and analyze network security events. . In the existing technology, network traffic data is generally monitored by monitoring the traffic collection configuration status of the traffic collection equipment and traffic mirroring equipment in the cyberspace shooting range. However, this method cannot guarantee that the collected traffic data is complete, nor can it guarantee that all nodes and connection statuses of the traffic collection and storage devices are normal.

The traffic data collected by applying the traffic monitoring method of the embodiment of the present disclosure must be complete, and therefore can accurately reflect the status of each node and connection in the traffic collection and storage device.

As shown in Figure 2, the traffic monitoring method according to the embodiment of the present disclosure includes:

Step 210: Obtain network security events from the security event database of the cyberspace shooting range;

Step 220: Obtain characteristic data of network security events;

Step 230: Based on the characteristic data, query the traffic data corresponding to the network security event in the traffic database of the cyberspace shooting range. The traffic database stores the full traffic mirroring data of network security events occurring in the cyberspace shooting range.

In step 210, network security events that occurred in the cyberspace shooting range are stored in the security event database. After using security equipment in the cyberspace range (such as firewalls/intrusion prevention systems/intrusion monitoring systems, etc.) to identify simulated offensive and defensive behavior events that occur in the cyberspace range, network security event data is generated through big data calculations, and a security event database exists. middle. When a network security incident occurs, corresponding traffic data will be generated. Therefore, traffic data can be used to determine the status of traffic collection and storage devices in the cyberspace range when a network security incident occurs.

In one embodiment, the method of obtaining network security events from the security event database of the cyberspace shooting range is real-time acquisition.

Cybersecurity incidents occurring in cyberspace ranges tend to be continuous. Therefore, the traffic data in the cyberspace range can be monitored in real time to ensure that continuous network security events can operate normally.

When a network security event occurs in the cyberspace shooting range, the network security event is stored in the security event database, and the traffic data is mirrored and stored in the traffic database. After the storage is completed, the network security event is obtained, and steps 220 to 230 are executed to implement real-time monitoring of traffic data.

Since the cyberspace shooting range can provide network security attack and defense drill scenarios for multiple objects at the same time, multiple network security incidents may occur in the cyberspace shooting range at the same time. However, a single network security event can often be used to detect anomalies in traffic collection and storage devices. It would undoubtedly be wasteful to monitor the traffic data of each network security event. Therefore, a predetermined number of network security events simultaneously stored in the security event database can be obtained. The predetermined number is often 1. In order to avoid inaccurate single monitoring results, the predetermined number can also be determined as 2 or 3. Obtaining a predetermined number of network security events can improve the monitoring efficiency of real-time monitoring, and using fewer network security events can reflect the real-time status of data collection and storage devices.

The advantage of using real-time acquisition to monitor data in real time is that the status of traffic data collection and storage can be monitored in a timely manner so that abnormal conditions can be processed in a timely manner, which improves the timeliness of processing abnormal conditions.

Since the cyberspace shooting range also needs to provide computing resources for the objects to conduct network security drills, if traffic monitoring and network security drills occur at the same time, the load on the cyberspace shooting range may be increased, thus affecting the efficiency of the network security drills. Therefore, in one embodiment, as shown in Figure 3, step 210 includes:

Step 310: Determine the monitoring cycle and monitoring duration;

Step 320: Determine the monitoring time interval according to the monitoring cycle and the monitoring duration;

Step 330: Randomly extract a predetermined number of network security events that occur within the monitoring time interval from the security event database of the cyberspace shooting range.

In this embodiment, the traffic is monitored according to a predetermined monitoring cycle, for example, the traffic is monitored every hour, and network security events that occur within the monitoring cycle are used to determine whether there is an abnormality in the status of the traffic collection and storage device during this period. The monitoring period can be pre-set to a fixed length, for example, 1 hour, 2 hours, etc.; it can also be dynamically adjusted according to the number of network security events that occur in the cyberspace range, for example, if the number of network security events increases sharply in a certain period of time , which is prone to abnormal flow data collection, so the monitoring cycle can be shortened appropriately to improve the accuracy of flow monitoring.

If there is an anomaly during the monitoring period, the anomaly will continue to exist without manual intervention. Therefore, it is not necessary to obtain the network security events during the entire monitoring period. Instead, the network security events within the monitoring period are obtained by determining the monitoring period. The monitoring duration is set to 1 minute, 5 minutes, 10 minutes, 15 minutes, etc., which can be determined according to the number of network security events that occur during the monitoring period. If the number of network security events that occur during the monitoring period is large, the monitoring period can be set to 1 minute, 5 minutes, 10 minutes, 15 minutes, etc. Set it shorter.

The monitoring time interval is the time period used for traffic monitoring in a monitoring cycle. The flow monitoring results within the monitoring time interval can reflect the flow monitoring results of the entire monitoring interval. The starting point of the monitoring time interval is the time point when the traffic monitoring is performed minus the monitoring duration, and the end point is the time point when the traffic monitoring is performed. For example, as shown in Figure 4, if the monitoring period is 1 hour, then traffic monitoring needs to be performed at 10:00, 11:00, and 12:00. The monitoring time is 15 minutes, then at 11:00, the monitoring time interval is from 10:45 to 11:00, and at 12:00, the monitoring time interval is from 11:45 to 12:00. If the data monitoring anomaly occurs between 10:00 and 10:45, then the anomaly still exists during the monitoring time interval from 10:45 to 11:00. Therefore, by monitoring the flow within a small range of time, the flow status of the entire monitoring period can be reflected.

After determining the monitoring time interval, a predetermined number of network security events occurring within the detection time interval are randomly selected from the security event database. The predetermined number of random draws is based on the loading of the cyberspace range. The larger the predetermined number, the more accurate the monitoring results will be, but the greater the load on the system. The determination of the predetermined number can be set to a fixed value, such as 10, according to the load of the cyberspace range; it can also be dynamically adjusted according to the number of network security events running in the cyberspace range, for example, the number of network security events currently running in the cyberspace range. If the number of network security events is large, it is necessary to reduce the scheduled number to ensure that traffic monitoring does not affect the normal operation of network security events.

The advantage of this embodiment is that traffic monitoring is performed according to a predetermined period to avoid traffic monitoring from seizing the computing resources required for network security drills in the cyberspace shooting range and affecting the normal progress of the drill.

In step 220, characteristic data of the network security event is obtained.

In one embodiment, obtaining the characteristic data of the network security event includes: obtaining the characteristic data of the network security event from a converged security event index library in the security event database.

The fused security event index database is generated based on multiple network security events in the security event database. The role of the fused security event index database in the cyberspace shooting range is to integrate network security events from different security devices for comprehensive analysis. . Therefore, the integrated security event index database will unify the format of multiple fields of different network security events for fusion. For example, network security events from different security devices may have different time formats. In the converged security event index database, events in different formats will be unified into the same format and sorted. The integrated security event index database will also deduplicate and eliminate network security events. For example, it can determine whether a network security event is a valid event through the network security event identifier or virtual LAN identifier. It can be seen that the data characteristics obtained by integrating the security event index database are more accurate and easier to find.

The main fields of network security events included in the Fusion Security Event Index Database are shown in Table 1:

Table 1

Since each network security event has a variety of characteristic data, event identification can be used to obtain characteristic data related to traffic data. In one embodiment, the signature data includes the source address, source port, destination address, destination port, virtual local area network identifier, and timestamp of the network security event.

The source address is the IP address of the initiator of the network security event; the source port is the port number of the initiator of the network security event; the destination address is the IP address of the receiver of the network security event; the target port is the receiver port of the network security event. No.; the virtual LAN identifier is a virtual network identifier running in the cyberspace range in isolation of network security events; the timestamp is the time when the network security event occurs.

The advantage of obtaining the above characteristic data from a variety of characteristic data is that the purpose of querying traffic data can be achieved by using a small amount of characteristic data, which improves query efficiency.

Based on this embodiment, the traffic database in step 230 contains multiple traffic interfaces. Each traffic interface corresponds to a network security event. The traffic data of the network security event can be obtained through the traffic interface. Each traffic interface contains the traffic start time, Traffic end time, traffic parameter group, the traffic parameter group includes the traffic virtual LAN identifier, traffic source address, traffic source port, traffic destination address, and traffic destination port. Therefore, as shown in Figure 5, step 230 includes:

Step 510: Determine candidate traffic ports in the traffic database based on the traffic start time, traffic end time, and timestamp;

Step 520: Based on the matching relationship between the source address and the traffic source address, the matching relationship between the source port and the traffic source port, the matching relationship between the target address and the traffic target address, the matching relationship between the target port and the traffic target port, the virtual LAN identifier and the traffic virtualization The matching relationship between LAN identifiers determines the target traffic port corresponding to the network security event among the candidate traffic ports;

Step 530: Return the traffic data of the network security event from the target traffic interface.

In this embodiment, the target traffic interface corresponding to the network security event is determined in the traffic database according to the obtained characteristic data of the network security event. The type of traffic interface can be RESTFUL API. The data content of the request header part of the traffic interface is shown in Table 2:

The data content of the request body of the traffic interface in Table 2 is shown in Table 3:

table 3

The request header part of the traffic interface contains the data information of the traffic interface and cannot be used to query the traffic data that can be retrieved through the traffic interface. The request body part contains the traffic data that can be retrieved through the traffic interface. Therefore, the traffic interface is queried through the request body.

First, candidate traffic ports are determined based on the traffic start time, traffic end time in the request body data, and the timestamp in the characteristic data of network security events. If the time of the network security event occurs between the traffic start time and the traffic end time, it means that the traffic data that can be retrieved by the traffic interface matches the time when the network security event occurs. Then select the target traffic interface from the time-matched candidate traffic interfaces. It should be noted that the time formats of traffic start time, traffic end time, and timestamp need to be unified for comparison.

"filterTupleArray" in the request body in Table 2 is the traffic parameter group, in which "vlanId" is the traffic virtual LAN identifier; "sourceIp" is the traffic source address; "destIp" is the traffic destination address; "sourcePort" is the traffic source port;" destPort" is the traffic destination port.

Only when the virtual LAN identifier in the characteristic data of the network security event is the same as the traffic virtual LAN identifier, the source address is the same as the traffic source address, the destination address is the same as the traffic destination address, the source port is the same as the traffic source port, and the destination port is equal to the traffic destination port , it means that the traffic data corresponding to this traffic interface is the traffic data of network security events, and the traffic interface is the target traffic port corresponding to network security events.

After the target traffic interface is found, the traffic data of the network security event is returned by the target traffic interface. The returned results are shown in Table 4:

serial number parameter name type illustrate 1 Code Integer type Query the task status, 0 means success, 1 means failure 2 Msg string If the task fails, failure information will be returned. 3 totalBytes string Query the total number of bytes of traffic data 4 totalPackets Integer type Query the total number of packets in traffic data

Table 4

The parameter "Code" in Table 4 is used to indicate whether the target traffic interface is queried. If it succeeds, it is 0, if it fails, it is 1, and the failure information is returned through the parameter "Msg". "totalBytes" and "totalPackets" represent the total number of bytes and total number of packets of the queried traffic data. If these two parameters are not 0, it means that the traffic collection and storage device status of the cyberspace shooting range is normal; otherwise, if If one of these two parameters is 0, it means that the traffic collection and storage device status of the cyberspace shooting range is abnormal.

The advantage of using the traffic interface to query traffic data in this embodiment is that it reduces the server load caused by directly querying traffic data and improves search efficiency. At the same time, the traffic data is not directly operated, which improves data security and accuracy.

The occurrence of network security events uses one-way traffic transmission from the sender to the receiver. In actual applications, it is possible that the traffic collection from the sender to the receiver is normal, but the traffic collection from the receiver to the sender is blocked. If another network security event is used to verify the status of receiver-to-sender traffic collection, it will increase the load on the cyberspace range. Therefore, in one embodiment, the network security event includes an event identifier, and the characteristic data in step 220 includes forward characteristic data and reverse characteristic data. Forward characteristic data is the characteristic data from the sender to the receiver of network security events; reverse characteristic data is the characteristic data from the receiver to the sender of network security events. Based on this, as shown in Figure 6, step 220 includes:

Step 610: Retrieve the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp of the network security event from the security event database according to the event identifier;

Step 620: Combine the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp into forward feature data;

Step 630: Use the target address as the reverse source address, the target port as the reverse source port, the source address as the reverse target address, and the source port as the reverse target port;

Step 640: Combine the reverse source address, reverse source port, reverse destination address, reverse destination port, virtual LAN identifier, and timestamp into reverse feature data.

Referring to Table 1, through the event identifier, the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp of the network security event can be obtained. These are forward characteristic data from the sender to the receiver.

Use the destination address as the reverse source address, the destination port as the reverse source port, the source address as the reverse destination address, and the source port as the reverse destination port. As shown in Figure 7, in this process, the forward sender is regarded as the reverse receiver, and the forward receiver is regarded as the reverse sender. The converted characteristic data is combined with the virtual LAN identifier and timestamp to obtain the reverse characteristic data.

The advantage of this embodiment is that a network security event is used to obtain bidirectional characteristic data to obtain bidirectional traffic characteristics, which ensures the integrity of traffic data query and improves monitoring efficiency.

Based on this embodiment, the traffic data includes forward traffic data and reverse traffic data. Therefore, as shown in Figure 8, step 230 includes:

Step 810: Determine the forward traffic data corresponding to the network security event in the traffic database based on the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp in the forward feature data;

Step 820: Determine the reverse traffic data corresponding to the network security event in the traffic database based on the reverse source address, reverse source port, reverse destination address, reverse destination port, virtual LAN identifier, and timestamp in the reverse feature data.

In this embodiment, the traffic data from the forward sender to the forward receiver can be obtained in the traffic database based on the forward characteristic data, and the traffic data from the reverse sender to the reverse receiver can be obtained based on the reverse characteristic data.

The process of determining forward traffic data in the traffic database based on the source address, source port, destination address, destination port, VLAN identifier, and timestamp is the same as in the previous embodiment, and will not be described again here.

The advantages of this embodiment are the same as those of obtaining bidirectional feature data in the previous embodiment, and will not be described again here.

Since the traffic database stores the full traffic mirror data of network security events that occur in the cyberspace shooting range, it can be guaranteed that the traffic data queried from the traffic database is the complete traffic of network security events.

In one embodiment, as shown in Figure 9, the traffic database obtains full traffic mirroring data of network security events through the following process:

Step 910: Insert traffic probes into each node of the cyberspace range;

Step 920: When a network security event occurs, use a traffic probe to capture traffic data;

Step 930: If the traffic probe captures traffic data at each node where the network security event occurs, the traffic data is mirrored and stored in the traffic database to obtain full traffic mirroring data.

In this embodiment, traffic probes are inserted into each node of the cyberspace range to capture traffic data. When a network security event occurs, the traffic probes of each node that the network security event passes through in the cyberspace shooting range are treated as a whole. Only when these traffic probes capture the traffic data can the traffic data be mirrored and stored in the traffic database. , to obtain full traffic mirroring data. As long as one traffic probe cannot capture traffic data, full traffic mirroring data cannot be formed in the traffic database.

Because of this, it can be ensured that the traffic data queried from the traffic database is the complete traffic of network security events. Therefore, this implementation ensures the integrity of the traffic data stored in the traffic database.

When the traffic data of network security events is queried in the traffic database, it means that there is no abnormality in the traffic collection and storage device, and the traffic monitoring of the next network security event can be carried out.

When the traffic data of network security events is not queried in the traffic database, it means that the status of the traffic collection and storage device is abnormal and needs to be processed.

In one embodiment, as shown in Figure 10, after step 230, the traffic monitoring method further includes:

Step 1010: If the traffic data corresponding to the network security event is not queried, initiate an alarm event;

Step 1020: Based on the alarm event, query the traffic data corresponding to the network security event again in the traffic database after a preset time interval.

If no traffic data is queried, the abnormal traffic characteristics are sent to the automatic exception handling platform through the exception handling interface for subsequent processing.

After receiving the alarm event, the automatic exception handling platform will query the traffic data corresponding to the network security event in the traffic database after a preset time interval. The purpose of this is to prevent the storage time difference between the traffic database and the security event database. That is, the security event database has stored network security events, but the traffic database has not yet stored the traffic data corresponding to the network security events. Therefore, query again after the preset time. If the traffic data can be queried, it means that the status of the traffic collection and storage device is normal. If the traffic data cannot be queried, it means that it is abnormal and needs to be repaired.

The advantage of this embodiment is that it avoids the problem of not being able to query traffic data due to storage time differences, and improves the accuracy of traffic monitoring.

Handling abnormal states requires obtaining information about network security events that generate alarms, simulated network areas, and traffic collection and storage devices. By checking the above information, troubleshoot abnormalities, fix specific problems in a predetermined way, and record logs. If it cannot be repaired or no status abnormality is found, the alarm needs to be notified to the relevant person in charge via text message or email. Manual intervention will check the above information, determine the cause of the abnormality, and solve the problem.

The overall flow of the traffic monitoring method in the embodiment of the present disclosure is shown in Figure 11. Network security events are obtained from the security event database; characteristic data of network security events are obtained; based on the characteristic data, traffic data of network security events are queried in the traffic database ; Determine whether the traffic data is queried; if yes, obtain the next network security event for traffic monitoring; if not, initiate an alarm event, and the automatic exception processing platform and the relevant person in charge will investigate the cause of the alarm and repair the abnormal state; after exception repair Afterwards, network security events are obtained again for traffic monitoring.

The apparatus and equipment of the embodiments of the present disclosure are described below.

It can be understood that although the steps in each of the above flowcharts are shown in sequence according to the arrows, these steps are not necessarily executed in the order represented by the arrows. Unless explicitly stated in this embodiment, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least some of the steps in the above flow chart may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution order of these steps or stages It does not necessarily need to be performed sequentially, but may be performed in turn or alternately with other steps or at least part of steps or stages in other steps.

It should be noted that in each specific implementation manner of the present application, when it is necessary to perform relevant processing based on the target virtual machine attribute information or attribute information collection and other data related to the characteristics of the target virtual machine, the target virtual machine will first be obtained. Permission or consent, and the collection, use and processing of such data will comply with relevant laws, regulations and standards of relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the attribute information of the target virtual machine, the individual permission or independent consent of the target virtual machine will be obtained through a pop-up window or jumping to a confirmation page. After explicitly obtaining the individual permission or independent consent of the target virtual machine, After agreeing, obtain the necessary target virtual machine-related data for normal operation of the embodiment of this application.

Figure 12 is a structural diagram of a flow monitoring device 1200 provided by an embodiment of the present disclosure. The flow monitoring device 1200 includes:

The first acquisition unit 1210 is used to acquire network security events from the security event database of the cyberspace shooting range;

The second acquisition unit 1220 is used to acquire characteristic data of network security events;

The first query unit 1230 is configured to query traffic data corresponding to network security events in the traffic database of the cyberspace shooting range based on the characteristic data, where the traffic database stores full traffic mirroring data of network security events occurring in the cyberspace shooting range.

Optionally, the first acquisition unit 1210 is specifically used to:

Determine the monitoring cycle and monitoring duration;

According to the monitoring cycle, the monitoring time interval is determined according to the monitoring duration;

Randomly select a predetermined number of network security events that occur within the monitoring time interval from the security event database of the cyberspace shooting range.

Optionally, the characteristic data includes the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp of the network security event.

Optionally, the traffic database contains multiple traffic interfaces, each traffic interface corresponds to a network security event; each traffic interface includes a traffic start time, a traffic end time, and a traffic parameter group, and the traffic parameter group includes a traffic virtual LAN Identification, traffic source address, traffic source port, traffic destination address, traffic destination port;

The first query unit 1230 is specifically used to:

Determine candidate traffic ports in the traffic database based on the traffic start time, traffic end time, and timestamp;

Based on the matching relationship between the source address and the traffic source address, the matching relationship between the source port and the traffic source port, the matching relationship between the destination address and the traffic destination address, the matching relationship between the destination port and the traffic destination port, the matching relationship between the virtual LAN identifier and the traffic virtual LAN identifier. Matching relationship, determine the target traffic port corresponding to the network security event among the candidate traffic ports;

The traffic data of network security events is returned by the target traffic interface.

Optionally, the network security event includes an event identifier;

Feature data includes forward feature data and reverse feature data;

The second acquisition unit 1220 is specifically used for:

Retrieve the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp of the network security event from the security event database according to the event identifier;

Combine the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp into forward feature data;

Use the destination address as the reverse source address, the destination port as the reverse source port, the source address as the reverse destination address, and the source port as the reverse destination port;

The reverse source address, reverse source port, reverse destination address, reverse destination port, virtual LAN identifier, and timestamp are combined into reverse feature data.

Optionally, the traffic data includes forward traffic data and reverse traffic data;

The first query unit 1230 is specifically used to:

Based on the source address, source port, destination address, destination port, virtual LAN identifier, and timestamp in the forward characteristic data, determine the forward traffic data corresponding to the network security event in the traffic database;

Based on the reverse source address, reverse source port, reverse destination address, reverse destination port, virtual LAN identifier, and timestamp in the reverse feature data, the reverse traffic data corresponding to the network security event is determined in the traffic database.

Optionally, the second acquisition unit 1220 is specifically used to:

Obtain characteristic data of network security events from the converged security event index library in the security event database; the converged security event index library is generated based on multiple network security events in the security event database.

Optionally, the traffic database obtains full traffic mirroring data of network security events through the following process:

Insert traffic probes into various nodes in the cyberspace range;

Use traffic probes to capture traffic data when network security incidents occur;

If the traffic probe captures traffic data at each node where a network security event occurs, the traffic data will be mirrored and stored in the traffic database to obtain full traffic mirroring data.

Optionally, the flow monitoring device 1200 also includes:

An alarm initiating unit (not shown), used to initiate an alarm event if the traffic data corresponding to the network security event is not queried;

The second query unit (not shown) is used to query the traffic data corresponding to the network security event in the traffic database again after a preset time interval based on the alarm event.

Referring to Figure 13, Figure 13 is a structural block diagram of a part of a control terminal that implements an embodiment of the present disclosure. The control terminal includes: a radio frequency (Radio Frequency, RF for short) circuit 1310, a memory 1315, an input unit 1330, a display unit 1340, and a sensor 1350 , audio circuit 1360, wireless fidelity (WiFi) module 1370, processor 1380, and power supply 1390 and other components. Those skilled in the art can understand that the terminal structure shown in Figure 13 is not limited to a mobile phone or a computer, and may include more or fewer components than shown in the figure, or combine certain components, or arrange different components.

The RF circuit 1310 can be used to receive and transmit information or signals during a call. In particular, after receiving downlink information from the base station, it is processed by the processor 1380; in addition, the designed uplink data is sent to the base station.

The memory 1315 can be used to store software programs and modules. The processor 1380 executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory 1315 .

The input unit 1330 may be used to receive input numeric or character information, and generate key signal input related to settings and function control of the terminal. Specifically, the input unit 1330 may include a touch panel 1331 and other input devices 1332.

The display unit 1340 may be used to display input information or provided information as well as various menus of the terminal. The display unit 1340 may include a display panel 1341.

The audio circuit 1360, speaker 1361, and microphone 1362 can provide an audio interface.

In this embodiment, the processor 1380 included in the terminal can execute the traffic monitoring method in the previous embodiment.

Control terminals in embodiments of the present disclosure include but are not limited to mobile phones, computers, intelligent voice interaction devices, aircraft, etc. Embodiments of the present invention can be applied to various scenarios, including but not limited to network security, communication security, etc.

FIG. 14 is a structural block diagram of a part of a server in a cyberspace shooting range that implements an embodiment of the present disclosure. The server may vary greatly due to different configurations or performance, and may include one or more central processing units (CPU) 1422 (for example, one or more processors) and memory 1432, and one or more storage units. Storage medium 1430 for application 1442 or data 1444 (eg, one or more mass storage devices). Among them, the memory 1432 and the storage medium 1430 may be short-term storage or persistent storage. The program stored in the storage medium 1430 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processor 1422 may be configured to communicate with the storage medium 1430 and execute a series of instruction operations in the storage medium 1430 on the server.

The server may also include one or more power supplies 1426, one or more wired or wireless network interfaces 1450, one or more input and output interfaces 1458, and/or, one or more operating systems 1441, such as Windows Server™, Mac OS X™ , UnixTM, LinuxTM, FreeBSDTM and so on.

The central processor 1422 in the server may be used to execute the traffic monitoring method of the embodiment of the present disclosure.

Embodiments of the present disclosure also provide a computer-readable storage medium, the computer-readable storage medium is used to store program code, and the program code is used to execute the traffic monitoring method of each of the foregoing embodiments.

An embodiment of the present disclosure also provides a computer program product, which includes a computer program. The processor of the computer device reads the computer program and executes it, so that the computer device executes the above traffic monitoring method.

The terms "first", "second", "third", "fourth", etc. (if present) in the description of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe specific objects. Sequence or sequence. It is to be understood that data so used are interchangeable under appropriate circumstances so that the embodiments of the disclosure described herein, for example, can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "include" and "comprises" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or apparatus that includes a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

It should be understood that in this disclosure, “at least one (item)” refers to one or more, and “plurality” refers to two or more. "And/or" is used to describe the relationship between associated objects, indicating that there can be three relationships. For example, "A and/or B" can mean: only A exists, only B exists, and A and B exist simultaneously. , where A and B can be singular or plural. The character "/" generally indicates that the related objects are in an "or" relationship. “At least one of the following” or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items). For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c" ”, where a, b, c can be single or multiple.

It should be understood that in the description of the embodiments of the present disclosure, the meaning of multiple (or multiple items) is two or more, greater than, less than, more than, etc. are understood as excluding the number, and above, below, within, etc. are understood as including the number.

In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.

A unit described as a separate component may or may not be physically separate. A component shown as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in various embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.

Integrated units may be stored in a computer-readable storage medium if they are implemented in the form of software functional units and sold or used as independent products. Based on this understanding, the technical solution of the present disclosure is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present disclosure. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., which can store program code. medium.

It should also be understood that the various implementation modes provided by the embodiments of the present disclosure can be combined arbitrarily to achieve different technical effects.

The above is a specific description of the embodiments of the present disclosure, but the disclosure is not limited to the above-mentioned embodiments. Those skilled in the art can also make various equivalent modifications or substitutions without violating the spirit of the disclosure. These equivalents Variations or substitutions are included within the scope defined by the claims of this disclosure.

Claims (13)

1. The flow monitoring method based on the network space target range is characterized by comprising the following steps of:

acquiring a network security event from a security event database of the network space shooting range;

acquiring characteristic data of the network security event;

and inquiring flow data corresponding to the network security event in a flow database of the network space target range based on the characteristic data, wherein the flow database stores full-flow mirror image data of the network security event in the network space target range.

2. The method of traffic monitoring according to claim 1, wherein said obtaining network security events from a security event database of the network space target comprises:

Determining a monitoring period and a monitoring duration;

according to the monitoring period, determining a monitoring time interval according to the monitoring duration;

randomly extracting a predetermined number of the network security events occurring during the monitoring time interval from the security event database of the network space target range.

3. The traffic monitoring method according to claim 1, wherein the characteristic data comprises a source address, a source port, a destination address, a destination port, a virtual local area network identification, and a timestamp of the network security event occurrence.

4. A method of traffic monitoring according to claim 3, wherein the traffic database comprises a plurality of traffic interfaces, each of the traffic interfaces corresponding to one of the network security events; each flow interface comprises a flow start time, a flow end time and a flow parameter set, wherein the flow parameter set comprises a flow virtual local area network identifier, a flow source address, a flow source port, a flow target address and a flow target port;

the querying, based on the feature data, flow data corresponding to the network security event in a flow database of the network space target range includes:

Determining candidate traffic ports in the traffic database based on the traffic start time, traffic end time, and the time stamp;

determining a target traffic port corresponding to the network security event in the candidate traffic ports based on the matching relationship of the source address and the traffic source address, the matching relationship of the source port and the traffic source port, the matching relationship of the target address and the traffic target address, the matching relationship of the target port and the traffic target port, and the matching relationship of the virtual local area network identifier and the traffic virtual local area network identifier;

the traffic data of the network security event is returned by the target traffic interface.

5. A method of traffic monitoring according to claim 3, wherein the network security event comprises an event identification;

the characteristic data comprises forward characteristic data and reverse characteristic data;

the acquiring the characteristic data of the network security event comprises the following steps:

invoking the source address, the source port, the destination address, the destination port, the virtual local area network identifier, and the timestamp of the network security event in the security event database according to the event identifier;

Combining the source address, the source port, the destination address, the destination port, the virtual local area network identification, and the timestamp into the forward feature data;

taking the target address as a reverse source address, taking the target port as a reverse source port, taking the source address as a reverse target address, and taking the source port as a reverse target port;

combining the reverse source address, the reverse source port, the reverse destination address, the reverse destination port, the virtual local area network identification, and the timestamp into the reverse feature data.

6. The flow monitoring method of claim 5, wherein the flow data comprises forward flow data and reverse flow data; the querying, based on the feature data, flow data corresponding to the network security event in a flow database of the network space target range includes:

determining forward traffic data corresponding to the network security event in the traffic database based on the source address, the source port, the destination address, the destination port, the virtual local area network identification, and the timestamp in the forward feature data;

And determining the reverse flow data corresponding to the network security event in the flow database based on the reverse source address, the reverse source port, the reverse target address, the reverse target port, the virtual local area network identifier and the timestamp in the reverse feature data.

7. The method of traffic monitoring according to claim 1, wherein the obtaining the characteristic data of the network security event comprises:

acquiring characteristic data of the network security event from a fusion security event index library in the security event database; the fused security event index library is generated based on a plurality of the network security events in the security event database.

8. The traffic monitoring method according to claim 1, wherein the traffic database obtains the full traffic mirror data of the network security event by:

inserting flow probes at each node of the network space range;

capturing the traffic data with the traffic probe upon occurrence of the network security event;

and if the flow probe captures the flow data at each node where the network security event occurs, mirroring the flow data and storing the flow data in the flow database to obtain the full-flow mirrored data.

9. The traffic monitoring method according to claim 1, wherein after the querying the traffic database of the cyber space yard for traffic data corresponding to the cyber security event based on the feature data, the traffic monitoring method further comprises:

if the flow data corresponding to the network security event is not queried, initiating an alarm event;

and based on the alarm event, querying the flow data corresponding to the network security event in the flow database again after a preset time interval.

10. A flow monitoring device based on network space range, characterized by comprising:

the first acquisition unit is used for acquiring network security events from a security event database of the network space shooting range;

the second acquisition unit is used for acquiring the characteristic data of the network security event;

and the first query unit is used for querying flow data corresponding to the network security event in a flow database of the network space target range based on the characteristic data, wherein the flow database stores full-flow mirror image data of the network security event in the network space target range.

11. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the flow monitoring method according to any one of claims 1 to 9 when executing the computer program.

12. A computer readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the flow monitoring method according to any one of claims 1 to 9.

13. A computer program product comprising a computer program, which computer program is read and executed by a processor of a computer device, causing the computer device to perform the flow monitoring method according to any one of claims 1 to 9.