CN206759503U - Data safety detection means - Google Patents

Data safety detection means Download PDF

Info

Publication number
CN206759503U
CN206759503U CN201720439328.2U CN201720439328U CN206759503U CN 206759503 U CN206759503 U CN 206759503U CN 201720439328 U CN201720439328 U CN 201720439328U CN 206759503 U CN206759503 U CN 206759503U
Authority
CN
China
Prior art keywords
data
metadata
acquisition server
data acquisition
processor
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201720439328.2U
Other languages
Chinese (zh)
Inventor
顾广宇
张淑娟
易庆
蔡翔
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
State Grid Corp of China SGCC
Electric Power Research Institute of State Grid Anhui Electric Power Co Ltd
Original Assignee
State Grid Corp of China SGCC
Electric Power Research Institute of State Grid Anhui Electric Power Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by State Grid Corp of China SGCC, Electric Power Research Institute of State Grid Anhui Electric Power Co Ltd filed Critical State Grid Corp of China SGCC
Priority to CN201720439328.2U priority Critical patent/CN206759503U/en
Application granted granted Critical
Publication of CN206759503U publication Critical patent/CN206759503U/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Alarm Systems (AREA)

Abstract

The utility model provides a kind of data safety detection means, it is related to the technical field of detection device, including data acquisition server, data processor and data storage, wherein, the quantity of data acquisition server is multiple, data processor includes interchanger and metadata processor, and interchanger is connected with each data acquisition server, metadata processor with data storage respectively, for realizing data acquisition server, the data communication between metadata processor and data storage;Data acquisition server is used to gather target metadata, and target metadata includes:Internet metadata, application layer metadata and operation metadata;Metadata processor is used to analyze and process the target metadata collected;Data storage is used to store the target metadata collected, alleviates the less efficient technical problem of traditional secure data detection means.

Description

Data safety detection means
Technical field
The technical field of detection device is the utility model is related to, more particularly, to a kind of data safety detection means.
Background technology
In recent years, with the fast development of informationization technology, increasing industry, mechanism have all gone on the hair of informationization Open up road.Conventional information technology progressively improves, and information-based industry is increasingly abundanter and grows, and data volume generates therewith Volatile growth.Information-based industry is thence into the epoch of big data, and in traditional Process of Information, people are just The problems such as beginning to focus on the informationization technology security that it is contained while offering convenience, stability, reliability.
Conventional information safety detection instrument is mostly limited as target, sphere of action to segment field, and user is for ensure ne The security context of network can only select to dispose multiclass safety product.Most of manufacturer is all realized by custom hardware simultaneously, is disposed Mode often has certain influence with position on user network framework or environment.These problems have resulted in system later maintenance difficulty Greatly, as technology development system is not easy upgrading extension, renewal cost is larger.
Utility model content
The purpose of this utility model is to provide a kind of data safety detection means, detected with alleviating traditional secure data The relatively low technical problem of unit efficiency.
According to one side of the present utility model, there is provided a kind of data safety detection means, including:Data acquisition service Device, data processor and data storage, wherein, the quantity of the data acquisition server is multiple, the data processor Including interchanger and metadata processor, the interchanger respectively with each data acquisition server, at the metadata Reason device is connected with the data storage, for realizing the data acquisition server, the metadata processor and described Data communication between data storage;The data acquisition server is used to gather target metadata, the target metadata Including:Internet metadata, application layer metadata and operation metadata;The metadata processor is used for described in collecting Target metadata is analyzed and processed;The data storage is used to store the target metadata collected.
Further, the data acquisition server includes:First data acquisition server, wherein, first data Acquisition server is connected by the interchanger with the metadata processor, for gathering the Internet in network to be protected Metadata;Second data acquisition server, wherein, second data acquisition server passes through the interchanger and first number It is connected according to processor, for gathering the application layer metadata in network to be protected;3rd data acquisition server, wherein, institute State the 3rd data acquisition server by the interchanger with the metadata processor to be connected, for gathering network to be protected In operation metadata.
Further, the metadata processor includes:First data-analyzing machine, first data-analyzing machine pass through institute Interchanger and the data acquisition server communication link are stated, for being analyzed and processed to the Internet metadata;Second Data-analyzing machine, second data-analyzing machine are used for by the interchanger and the data acquisition server communication link The application layer metadata is analyzed and processed;3rd data-analyzing machine, the 3rd data-analyzing machine pass through the exchange Machine and the data acquisition server communication link, for being analyzed and processed to the operation metadata.
Further, the data processor also includes:Alarm device, the alarm device pass through the interchanger and the member Data processor is connected, and the alarm device is used to obtain the security incident that the metadata processor is sent, with according to Security incident is alerted, wherein, the security incident is that the metadata processor is analyzed the target metadata What processing obtained.
Further, the alarm device includes PC or alarm server.
Further, the alarm server includes:Mail alarm and Short message alarm;Wherein, the mail alarm Device is alerted by way of sending mail;The Short message alarm is alarmed by way of sending short message.
Further, the interchanger is the gigabit switch for including 24 data communication ports, or, it is to include 24 10,000,000,000 interchangers of data communication port.
Further, the metadata processor includes following any:Configure the Hadoop of stream stream process functions Distributed type assemblies server, spark distributed memory cluster servers.
Further, the data storage includes:It is configured with the distributed collection of Hadoop of Hbase non-relational databases Group's server.
Further, first network port is provided with each data acquisition server, is set on the interchanger There is second network port, be provided with the 3rd network port, and the data storage and set in the metadata processor There is the 4th network port;Wherein, it is connected between the first network port and second network port by the first order wire Connect;Second network port is connected with the 3rd network port by the second order wire;Second network port and 4th network port is connected by third communication line.
In the data safety detection means that the utility model embodiment provides, including data acquisition server, at data Device and data storage are managed, the quantity of data acquisition server is multiple, and data processor includes interchanger and metadata is handled Device, interchanger is connected with each data acquisition server, metadata processor with data storage respectively, for realizing data Acquisition server, the data communication between metadata processor and data storage.Wherein, data acquisition server is used to gather Target metadata, target metadata include:Internet metadata, application layer metadata and operation metadata;Metadata processor For being analyzed and processed to the target metadata collected;Data storage is used to deposit the target metadata collected Storage.In the utility model embodiment, it can carry out safety detection from network using with three aspects of main frame, treated with realizing Network full protection is protected, has reached purpose that is stable and efficiently being monitored in real time to network, and then alleviate traditional peace The less efficient technical problem of full data detection device.
Brief description of the drawings
, below will be right in order to illustrate more clearly of the utility model embodiment or technical scheme of the prior art The required accompanying drawing used is briefly described in embodiment or description of the prior art, it should be apparent that, describe below In accompanying drawing be some embodiments of the present utility model, for those of ordinary skill in the art, do not paying creativeness On the premise of work, other accompanying drawings can also be obtained according to these accompanying drawings.
Fig. 1 is the schematic diagram according to the optional data safety detection means of the first in the utility model embodiment;
Fig. 2 is the schematic diagram according to second in the utility model embodiment optional data safety detection means;
Fig. 3 is the schematic diagram according to the optional data safety detection means of the third in the utility model embodiment;
Fig. 4 is the schematic diagram according to the 4th kind in the utility model embodiment optional data safety detection means.
Embodiment
The technical solution of the utility model is clearly and completely described below in conjunction with accompanying drawing, it is clear that described Embodiment is the utility model part of the embodiment, rather than whole embodiments.Based on the embodiment in the utility model, sheet The every other embodiment that field those of ordinary skill is obtained under the premise of creative work is not made, belongs to this practicality Novel protected scope.
, it is necessary to explanation in description of the present utility model, term " " center ", " on ", " under ", it is "left", "right", " perpendicular Directly ", the orientation of the instruction such as " level ", " interior ", " outer " or position relationship are based on orientation shown in the drawings or position relationship, are only Described for the ease of description the utility model and simplifying, rather than instruction or imply signified device or element must have it is specific Orientation, with specific azimuth configuration and operation, therefore it is not intended that to limitation of the present utility model.In addition, term " the One ", " second ", " the 3rd " are only used for describing purpose, and it is not intended that instruction or hint relative importance.
, it is necessary to which explanation, unless otherwise clearly defined and limited, term " are pacified in description of the present utility model Dress ", " connected ", " connection " should be interpreted broadly, for example, it may be fixedly connected or be detachably connected, or integratedly Connection;Can be mechanical connection or electrical connection;Can be joined directly together, can also be indirectly connected by intermediary, It can be the connection of two element internals.For the ordinary skill in the art, above-mentioned art can be understood with concrete condition Concrete meaning of the language in the utility model.
According to the utility model embodiment, there is provided a kind of embodiment of data safety detection means.
Fig. 1 is according to a kind of schematic diagram of data safety detection means of the utility model embodiment, as shown in figure 1, should Data safety detection means includes:Data acquisition server 10, data processor 20 and data storage 30, wherein, data are adopted The quantity for collecting server 10 is multiple, and data processor 20 includes interchanger 21 and metadata processor 22, and interchanger 21 is distinguished With data acquisition server 10, metadata processor 22 is connected with data storage 30, for realizing data acquisition server 10, the data communication between metadata processor 22 and data storage 30.
It should be noted that the data safety detection means that the utility model embodiment provides can be applied to big data ring Under border, a kind of information safety testing device of efficient stable is provided for the network under big data environment.Data safety detection dress Putting can be from network, using carrying out safety detections with three aspects of main frame and provide metadata, so that subsequent analysis uses.Specifically Ground, in the utility model embodiment, mainly carried out by data acquisition server 10, data processor 20 and data storage 30 The safety detection of data.
Specifically, data acquisition server 10 is used to gather target metadata, and target metadata includes:Internet member number According to application layer metadata and operation metadata;
Metadata processor 22 is used to analyze and process the target metadata collected;
Data storage 30 is used to store the target metadata collected.
In the data safety detection means that the utility model embodiment provides, including data acquisition server, at data Device and data storage are managed, the quantity of data acquisition server is multiple, and data processor includes interchanger and metadata is handled Device, interchanger is connected with each data acquisition server, metadata processor with data storage respectively, for realizing data Acquisition server, the data communication between metadata processor and data storage.Wherein, data acquisition server is used to gather Target metadata, target metadata include:Internet metadata, application layer metadata and operation metadata;Metadata processor For being analyzed and processed to the target metadata collected;Data storage is used to deposit the target metadata collected Storage.In the utility model embodiment, it can carry out safety detection from network using with three aspects of main frame, treated with realizing Network full protection is protected, has reached purpose that is stable and efficiently being monitored in real time to network, and then alleviate traditional peace The less efficient technical problem of full data detection device.
In an optional embodiment, as shown in Fig. 2 data acquisition server 10 includes:First data acquisition service Device 11, the second data acquisition server 12 and the 3rd data acquisition server 13.
Wherein, the first data acquisition server is connected by interchanger with metadata processor, to be protected for gathering Internet metadata in network;
Specifically, the first data acquisition server is properly termed as Internet acquisition server, Internet acquisition server again Network layer protocol for treating packet in protection network is parsed, and to form Internet metadata, and passes through interchanger It is sent in metadata processor and is analyzed and processed.
Second data acquisition server is connected by interchanger with metadata processor, for gathering in network to be protected Application layer metadata;
Specifically, the second data acquisition server is properly termed as application layer acquisition server, application layer acquisition server again Application layer protocol for treating the packet in protection network is parsed, and is formed application layer metadata and is sent at metadata Analyzed and processed in reason device.
3rd data acquisition server is connected by interchanger with metadata processor, for gathering in network to be protected Operation metadata;
3rd data acquisition server is properly termed as host computer side acquisition server again, for treating the PC in protection network Or the operation data in server is acquired, formation host service function metadata, which is sent in metadata processor, to be carried out at analysis Reason.
It should be noted that in the utility model embodiment, the first data acquisition server and the second data acquisition clothes Business device can use common PC or standard server comprising gigabit or 10,000,000,000 double netcards;3rd data acquisition server can portion Affix one's name on the destination host or server in network to be protected.By the set-up mode, facilitate the portion of data safety detection means Administration, while a kind of more stable detection means can be provided for network to be protected, realize multifaceted network safety prevention.
Explanation is needed further exist for, in the utility model embodiment, the particular number of data acquisition server can be with Dynamically adjusted according to the interior joint scale of network to be protected, network traffics size;Secondly can be according to of network to be protected Property demand, data acquisition server can realize dynamic position deployment and need not immobilize.
Above-mentioned first data acquisition server 11, the second data acquisition server 12 and the 3rd data acquisition server 13 exist After collecting metadata respectively, it is possible to respective metadata is sent in metadata processor 22 by interchanger 21 Analyzed and processed.Metadata processor 22 is after all kinds of metadata of data acquisition server transmission are received, to target Metadata is analyzed and processed, to obtain security incident.
After analysis obtains security incident, the can of metadata processor 21 is pushed security incident by interchanger 21 Alarm device 23 into data processor 20.Alarm device 23 is after the security incident is received, according to correspondingly rule safety Event carries out the alarm of different modes.Wherein, above-mentioned alarm device 23 includes PC or alarm server, and alarm server can be with For common server.
Further, alarm server includes mail alarm and Short message alarm.Wherein, mail alarm mainly with The form of mail is alerted, and Short message alarm is mainly alarmed in the form of short message.
As shown in figure 3, alarm device 23 is communicated to connect by interchanger 21 and metadata processor 22.That is, at this In utility model embodiment, interchanger 21 is used for data acquisition server 10, and metadata processor 22, alarm device 23 and data are deposited Communication connection between reservoir 30.
It should be noted that in the utility model embodiment, data acquisition server with network to be protected with it is each When class interchanger is connected, the traffic mirroring mode using mature and reliable is supported, in the case where the former network architecture need not be changed, Can rapid deployment;On the other hand the other end and switchboard direct connection of each data acquisition server, without in former network environment It is middle to introduce new network traffics, greatly protect the service in former network.
In another optional embodiment, interchanger 21 is the gigabit switch for including 24 data communication ports, or Person, it is 10,000,000,000 interchangers for including 24 data communication ports.
In another optional embodiment, metadata processor can be distributed high performance processor.
Specifically, metadata processor can be for all kinds of metadata Treatment Analysis processes, configure at stream streams Manage the Hadoop distributed type assemblies servers of function, Spark distributed memory cluster servers.
Metadata processor can also be the Spark distributed memories cluster clothes for all kinds of metadata Treatment Analysis processes Business device.
In the utility model embodiment, metadata processor uses distributed processors, therefore, has splendid extension Property, the disposal ability of processor can be adjusted in running according to metadata streams gauge mould dynamic.In long-term development Can be according to the calculate node of specific calculation process increase in demand metadata processor, and need not reconstruct or redeploy data Safety detection device.
In an optional embodiment, as shown in figure 4, metadata processor 22 includes:First data-analyzing machine 221, Second data-analyzing machine 222 and the 3rd data-analyzing machine 223.
Specifically, the first data-analyzing machine 221 is by interchanger and data acquisition server communication link, for network Layer metadata is analyzed and processed;
Second data-analyzing machine 22 is by interchanger and data acquisition server communication link, for application layer metadata Analyzed and processed;
3rd data-analyzing machine 223 is by interchanger and data acquisition server communication link, for operation metadata Analyzed and processed.
It should be noted that in the utility model embodiment, can be according to the data included in metadata processor 22 Interface increases data-analyzing machine newly, for example, the 4th data-analyzing machine of increase, or, increase by the 5th data-analyzing machine, to improve first number According to the analysis ability and analysis efficiency of processor.
In another optional embodiment, data storage 30 can use high performance distributed memory system, with The target metadata of big flow is received, and provides efficient retrieval with reading.
Wherein, data storage includes:It is configured with the Hadoop distributed type assemblies services of Hbase non-relational databases Device.The read-write efficiency of data can be improved from the data storage, to provide efficient retrieval.
In another optional embodiment, first network port, interchanger are provided with each data acquisition server On be provided with second network port, the 3rd network port is provided with metadata processor, the 4th is provided with data storage The 5th network port is provided with the network port, and alarm device 23;
Wherein, it is connected between first network port and second network port by the first order wire;Second network port It is connected with the 3rd network port by the second order wire;Second network port and the 4th network port pass through third communication line phase Connection;Second network port and the 5th network port are connected by fourth communication line.
Specifically, each data acquisition server 10 is connected by the first order wire with interchanger 21;Metadata processing Device 22 is connected by the second order wire with interchanger 21;Data storage 30 is connected by third communication line with interchanger 21 Connect;Alarm device 23 is connected by fourth communication line with interchanger 21.
Wherein, the above-mentioned network port is all communicated using the network interface of RJ45 specifications, and by wired local area network.
To sum up, in order to preferably meet under big data environment to information security detection requirement, it is necessary to one kind to existing net Network influences smaller, convenient to carry out data safety detection means, on the one hand the data safety detection means can provide stage construction Safety detection ability, on the other hand disclosure satisfy that under big data environment for the quick circulation of data and the requirement of efficient process, Realize rapid deployment and Function Extension.
The data safety detection means provided in utility model embodiment, the frame separated using data acquisition and procession Structure, it is easy to deployment to calculate the characteristics of performance is expansible with metadata processor with reference to data acquisition server, can be according to safety Demand customizes new data acquisition server access data safety detection means, quickly realizes expanding of system function, high effect To security threat.
Finally it should be noted that:Various embodiments above is only to illustrate the technical solution of the utility model, rather than it is limited System;Although the utility model is described in detail with reference to foregoing embodiments, one of ordinary skill in the art should Understand:It can still modify to the technical scheme described in foregoing embodiments, either to which part or whole Technical characteristic carries out equivalent substitution;And these modifications or replacement, the essence of appropriate technical solution is departed from this practicality newly The scope of each embodiment technical scheme of type.

Claims (10)

  1. A kind of 1. data safety detection means, it is characterised in that including:Data acquisition server, data processor and data are deposited Reservoir, wherein, the quantity of the data acquisition server is multiple, and the data processor includes interchanger and metadata is handled Device, the interchanger respectively with each data acquisition server, the metadata processor and the data storage phase Connection, for realizing the data acquisition server, the data between the metadata processor and the data storage are led to News;
    The data acquisition server is used to gather target metadata, and the target metadata includes:Internet metadata, application Layer metadata and operation metadata;
    The metadata processor is used to analyze and process the target metadata collected;
    The data storage is used to store the target metadata collected.
  2. 2. data safety detection means according to claim 1, it is characterised in that the data acquisition server includes:
    First data acquisition server, wherein, first data acquisition server passes through the interchanger and the metadata Processor is connected, for gathering the Internet metadata in network to be protected;
    Second data acquisition server, wherein, second data acquisition server passes through the interchanger and the metadata Processor is connected, for gathering the application layer metadata in network to be protected;
    3rd data acquisition server, wherein, the 3rd data acquisition server passes through the interchanger and the metadata Processor is connected, for gathering the operation metadata in network to be protected.
  3. 3. data safety detection means according to claim 2, it is characterised in that the metadata processor includes:
    First data-analyzing machine, first data-analyzing machine are joined by the interchanger and data acquisition server communication Connect, for being analyzed and processed to the Internet metadata;
    Second data-analyzing machine, second data-analyzing machine are joined by the interchanger and data acquisition server communication Connect, for being analyzed and processed to the application layer metadata;
    3rd data-analyzing machine, the 3rd data-analyzing machine are joined by the interchanger and data acquisition server communication Connect, for being analyzed and processed to the operation metadata.
  4. 4. data safety detection means according to claim 1, it is characterised in that the data processor also includes:
    Alarm device, the alarm device are connected by the interchanger with the metadata processor, and the alarm device is used to obtain The security incident for taking the metadata processor to send, to be alerted according to the security incident, wherein, the security incident The metadata processor is analyzed and processed to obtain to the target metadata.
  5. 5. data safety detection means according to claim 4, it is characterised in that the alarm device includes PC or announcement Alert server.
  6. 6. data safety detection means according to claim 5, it is characterised in that the alarm server includes:Mail Alarm and Short message alarm;
    Wherein, the mail alarm is alerted by way of sending mail;
    The Short message alarm is alarmed by way of sending short message.
  7. 7. data safety detection means according to claim 1, it is characterised in that the interchanger is to include 24 data The gigabit switch of PORT COM, or, it is 10,000,000,000 interchangers for including 24 data communication ports.
  8. 8. data safety detection means according to claim 1, it is characterised in that the metadata processor includes following It is any:Configure the Hadoop distributed type assemblies servers of stream stream process functions, Spark distributed memory cluster services Device.
  9. 9. data safety detection means according to claim 1, it is characterised in that the data storage includes:Configuration There are the Hadoop distributed type assemblies servers of Hbase non-relational databases.
  10. 10. data safety detection means according to claim 1, it is characterised in that each data acquisition server On be provided with first network port, second network port is provided with the interchanger, is provided with the metadata processor The 4th network port is provided with 3rd network port, and the data storage;
    Wherein, it is connected between the first network port and second network port by the first order wire;Described second The network port is connected with the 3rd network port by the second order wire;Second network port and the 4th network Port is connected by third communication line.
CN201720439328.2U 2017-04-24 2017-04-24 Data safety detection means Expired - Fee Related CN206759503U (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201720439328.2U CN206759503U (en) 2017-04-24 2017-04-24 Data safety detection means

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201720439328.2U CN206759503U (en) 2017-04-24 2017-04-24 Data safety detection means

Publications (1)

Publication Number Publication Date
CN206759503U true CN206759503U (en) 2017-12-15

Family

ID=60614874

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201720439328.2U Expired - Fee Related CN206759503U (en) 2017-04-24 2017-04-24 Data safety detection means

Country Status (1)

Country Link
CN (1) CN206759503U (en)

Similar Documents

Publication Publication Date Title
CN111543038B (en) Network stream splicing using middleware stream splicing
CN103870297B (en) The performance data collection system and method for virtual machine in cloud computing environment
US20160357424A1 (en) Collapsing and placement of applications
CN102724063B (en) Log acquisition server and packet delivery, Log Clustering method and network
CN106709003A (en) Hadoop-based mass log data processing method
CN107690776A (en) For the method and apparatus that feature is grouped into the case for having selectable case border in abnormality detection
CN102148827B (en) Security event management method, device and security management platform
CN100534096C (en) System and method for reverse network fishing
CN105677842A (en) Log analysis system based on Hadoop big data processing technique
CN107025222A (en) A kind of distributed information log acquisition method and device
CN108880943A (en) A kind of monitoring system of isomery cloud platform
CN107040405B (en) Passive type various dimensions host Fingerprint Model construction method and its device under network environment
CN111557087A (en) Discovering intermediate devices using traffic stream stitching
CN106559498A (en) Air control data collection platform and its collection method
CN107426017A (en) A kind of method for carrying out data analysis by gathering switch network flow
CN109714222A (en) The distributed computer monitoring system and its monitoring method of High Availabitity
CN109495501A (en) Network security Dynamic Asset management system
CN102316122A (en) Method for managing intranet security based on cooperative mode
CN106446008A (en) Management method and analysis system for database security event
CN105827454A (en) Method and system for constructing topologic CDN (content delivery network) model
CN206759503U (en) Data safety detection means
CN107360153A (en) A kind of network security protection system on big data
CN106855888A (en) Daily record monitoring system based on Logstash distributed systems
Calderon et al. Management and monitoring IoT networks through an elastic stack-based platform
CN209030332U (en) One kind being based on video image intelligent community management application system

Legal Events

Date Code Title Description
GR01 Patent grant
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20171215

Termination date: 20180424