Movatterモバイル変換


[0]ホーム

URL:


CN111404888B - Network data auditing method and device - Google Patents

Network data auditing method and device
Download PDF

Info

Publication number
CN111404888B
CN111404888BCN202010145311.2ACN202010145311ACN111404888BCN 111404888 BCN111404888 BCN 111404888BCN 202010145311 ACN202010145311 ACN 202010145311ACN 111404888 BCN111404888 BCN 111404888B
Authority
CN
China
Prior art keywords
data
network
verified
key information
audit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202010145311.2A
Other languages
Chinese (zh)
Other versions
CN111404888A (en
Inventor
何林
刘莹
任罡
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tsinghua University
Original Assignee
Tsinghua University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tsinghua UniversityfiledCriticalTsinghua University
Priority to CN202010145311.2ApriorityCriticalpatent/CN111404888B/en
Publication of CN111404888ApublicationCriticalpatent/CN111404888A/en
Application grantedgrantedCritical
Publication of CN111404888BpublicationCriticalpatent/CN111404888B/en
Activelegal-statusCriticalCurrent
Anticipated expirationlegal-statusCritical

Links

Images

Classifications

Landscapes

Abstract

Translated fromChinese

本发明公开了一种网络数据审计方法和装置,方法包括若获取到访问设备的网络数据,从所述网络数据中提取N组需验证数据;基于预先构建的审计模型,分别对每组组需验证数据中每个所述关键信息和所述关联关系进行审计,得到审计结果;若所述审计结果表示未通过,对网络进行保护,实现了基于多个数据进行验证后的审计结果对网络进行保护。采用本发明的技术方案,能够提高网络数据的审计结果的准确性,减少网络安全事件发生,进而提高网络安全性。

Figure 202010145311

The invention discloses a network data auditing method and device. The method comprises: if network data of an access device is acquired, extracting N groups of data to be verified from the network data; Each of the key information and the association relationship in the verification data is audited, and an audit result is obtained; if the audit result indicates that it fails, the network is protected, and the network is implemented based on the audit results after verification of multiple data. Protect. By adopting the technical scheme of the present invention, the accuracy of the audit result of the network data can be improved, the occurrence of network security events can be reduced, and the network security can be further improved.

Figure 202010145311

Description

Network data auditing method and device
Technical Field
The invention belongs to the technical field of network security, and particularly relates to a network data auditing method and device.
Background
Network security is one of the major challenges facing the internet. In recent years, the global network security situation is becoming more severe, and the network security is being promoted to the strategic height of national security.
At present, a mode of identifying an IP address is usually adopted to identify network access equipment, so that the network security is guaranteed. For example, the current IP address is resolved to determine whether the current IP address is consistent with the hidden user IP address, thereby determining whether the network is attacked.
However, since source address forgery, dynamic address allocation and address translation, host mobility, and the like are widely available, the IP address is easily cracked, tampered, forged, and the like, so that the IP address for attacking the network is identified as valid, the network is maliciously attacked, and the network security is reduced.
Disclosure of Invention
The invention mainly aims to provide a network data auditing method and device to solve the problem of low network security in the prior art.
In view of the above problem, in a first aspect, the present invention provides a network data auditing method, including the following steps:
if network data of the access equipment are acquired, extracting N groups of data to be verified from the network data; each group of data to be verified comprises at least two key information and the incidence relation of all key information, each group of data to be verified is different, and each key information in each group of data to be verified is different; n is a positive integer;
auditing each key information and the association relation respectively based on a pre-constructed auditing model to obtain an auditing result;
and if the audit result shows that the network fails, protecting the network.
Further, in the method, the auditing each piece of the key information and the association relation based on a pre-established auditing model to obtain an auditing result includes:
comparing each piece of key information with independent verification information preset in the audit model to obtain a first comparison result, and comparing the key information with associated verification information preset in the audit model to obtain a second comparison result;
if the first comparison result and the second comparison result both represent matching, obtaining an audit result representing passing;
and if the first comparison result and/or the second comparison result show that the first comparison result and/or the second comparison result do not match, obtaining an audit result showing that the audit result does not pass.
Further, in the above method, one of the N sets of data to be verified includes two pieces of the key information, where the first key information is an identity and the second key information is a source address; the identity identification comprises a user identification and/or an access equipment identification;
correspondingly, the individual authentication information comprises an authentication identity or an authentication source address; the authentication identity comprises a user authentication identity and/or an access device authentication identity.
Further, the method described above further includes:
and if the auditing result shows that the user does not pass the auditing method, tracing the user according to the user identification, and/or tracing the use information of the access equipment according to the access equipment identification.
Further, in the above method, the process of constructing the audit model includes:
processing the original information corresponding to each individual verification information to obtain processing information with uniqueness and/or anti-counterfeiting property as the individual verification information;
and performing association processing on all the individual verification information to obtain the associated verification information.
Further, in the above method, the associating all the individual verification information includes:
and binding all the single verification information, and/or embedding all the single verification information in a plaintext and/or ciphertext mode.
Further, in the method, before the auditing the key information and/or the association relation based on the pre-established auditing model to obtain the auditing result, the method further includes:
if the N is greater than or equal to 2, determining the security level of the network;
and determining the number of the groups of the data to be verified according to the security level of the network.
Further, in the method, the security level of the network is preset, or the security level of the network is determined according to the N.
Further, in the method, the determining, according to the security level of the network, the number of groups of the data to be verified is selected includes:
if the security level of the network is lower than a preset level, randomly selecting a group of data to be verified;
and if the network security level is greater than or equal to the preset level, at least two groups of data to be verified are randomly selected.
In a second aspect, the present invention provides a network data auditing apparatus, including:
the extraction module is used for extracting N groups of data to be verified from the network data if the network data of the access equipment is acquired; each group of data to be verified comprises at least two key information and the incidence relation of all key information, each group of data to be verified is different, and each key information in each group of data to be verified is different; n is a positive integer;
the auditing module is used for auditing each key information and the association relation respectively based on a pre-constructed auditing model to obtain an auditing result;
and the protection module is used for protecting the network if the audit result shows that the audit result does not pass.
Compared with the prior art, one or more embodiments in the above scheme can have the following advantages or beneficial effects:
by applying the network data auditing method and device, N groups of data to be verified are extracted from the network data when the network data of the access equipment is acquired; and auditing the incidence relation between each key information and all key information in each group of data to be verified respectively based on a pre-constructed audit model, and protecting the network under the condition that the obtained audit result indicates failure, so that the network is protected based on the audit result after a plurality of data are verified. By adopting the technical scheme of the invention, the accuracy of the audit result of the network data can be improved, the occurrence of network security events can be reduced, and the network security can be further improved.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention and not to limit the invention. In the drawings:
FIG. 1 is a flow chart of a first embodiment of a network data auditing method of the present invention;
FIG. 2 is a flow chart of a second embodiment of a network data auditing method of the present invention;
FIG. 3 is a schematic structural diagram of a first embodiment of a network data auditing apparatus according to the present invention;
FIG. 4 is a schematic structural diagram of a second embodiment of a network data auditing apparatus according to the present invention;
fig. 5 is a schematic structural diagram of an embodiment of the network data auditing apparatus of the present invention.
Detailed Description
The following detailed description of the embodiments of the present invention will be provided with reference to the drawings and examples, so that how to apply the technical means to solve the technical problems and achieve the technical effects can be fully understood and implemented. It should be noted that, as long as there is no conflict, the embodiments and the features of the embodiments of the present invention may be combined with each other, and the technical solutions formed are within the scope of the present invention.
In order to solve the technical problems in the prior art, an embodiment of the present invention provides a network data auditing method.
Fig. 1 is a flowchart of a first embodiment of a network data auditing method according to the present invention, and referring to fig. 1, the network data auditing method according to this embodiment includes the following steps:
100. if the network data of the access equipment is acquired, extracting N groups of data to be verified from the network data;
in a specific implementation process, network data when the access device accesses a network may be acquired, the network data may be analyzed, and N groups of data to be verified may be extracted from the network data, where N is a positive integer. In this embodiment, each set of data to be verified includes at least two pieces of key information and an association relationship between all pieces of key information, each set of data to be verified is different, and each piece of key information in each set of data to be verified is different.
101. Auditing the incidence relation of each key information and all key information respectively based on a pre-constructed audit model to obtain an audit result;
in one specific implementation, the pre-constructed audit model may be constructed in the network layer as follows:
A. processing the original information corresponding to each individual verification information to obtain processing information with uniqueness and/or anti-counterfeiting property as individual verification information;
specifically, the field designated by the original information corresponding to each individual verification information may be processed in a manner of signing, calculating by using a special algorithm, and the like, so that the original information corresponding to each individual verification information has uniqueness and/or anti-counterfeiting property, and the processed information of uniqueness and/or anti-counterfeiting property obtained after processing is stored as each individual verification information.
For example, in this embodiment, a group of data to be verified in the N groups of data to be verified includes two pieces of key information, where the first piece of key information is an identity identifier, and the identity identifier includes a user identifier and/or an access device identifier; the second key information is the source address. Correspondingly, the individual authentication information comprises an authentication identity or an authentication source address; the authentication identity includes a user authentication identity and/or an access device authentication identity. The signature processing can be carried out on relevant fields such as the identification and the source address, so that the identification and the source address have uniqueness and/or anti-counterfeiting performance.
B. And performing association processing on all the individual verification information to obtain associated verification information.
In a specific implementation process, all the individual authentication information may be bound based on an external packet association principle, for example, an association table may be established, and each individual authentication information may be associated in sequence. The out-of-packet association principle can be understood as a parallel mode between each individual authentication information.
In this embodiment, based on the principle of intra-packet association, all the individual pieces of authentication information may be embedded, for example, all the individual pieces of authentication information may be embedded in a plaintext and/or ciphertext manner. Specifically, at least one of the individual authentication information may be embedded in the other individual authentication information after being subjected to plaintext and/or ciphertext processing. Wherein, the intra-packet association principle can be understood as the dependency relationship between each individual authentication information.
In practical application, a user can construct a required audit model in a network layer in advance according to own requirements and based on the process of constructing the audit model, so that the audit model has good expandability.
Specifically, each piece of key information may be compared with individual verification information preset in the audit model to obtain a first comparison result, and the key information may be compared with associated verification information preset in the audit model to obtain a second comparison result; if the first comparison result and the second comparison result both represent matching, obtaining an audit result representing passing; and if the first comparison result and/or the second comparison result show no match, obtaining an audit result showing failure.
For example, the keyword comparison may be performed on the user identifier and the user verification identifier to determine whether the two are matched, in this embodiment, it is preferable that the user identifier and the user verification identifier are considered to be matched when they are completely consistent, otherwise, they are not matched. Similarly, the access device identification can be compared with the access device verification identification, so as to judge whether the access device identification is matched with the access device verification identification; and comparing the source address with the verification source address so as to judge whether the source address is matched with the verification source address. If the first comparison result and the second comparison result both represent matching, obtaining an audit result representing passing, and having no network attack; and if the first comparison result and/or the second comparison result show that the first comparison result and/or the second comparison result do not match, obtaining an audit result showing that the audit result fails, and having network attack.
In the embodiment, because the incidence relation between each piece of key information and all pieces of key information is audited, if an attacker attacks the network, all data in the data to be verified need to be cracked, tampered, forged and the like, and for the attacker, the difficulty of cracking all the data is higher, so that the attacker is effectively deterred, and the occurrence of network security events is reduced.
102. And if the obtained audit result indicates that the network fails, protecting the network.
In this embodiment, if the obtained audit result indicates that the network attack does not pass, it indicates that the network attack exists, and at this time, the network needs to be protected. For example, after the identity of the attacker is known, the filtering service may be based on auditability, that is, after the identity of the attacker is known, the filtering based on the identity of the attacker may be directly implemented, so that the attacker cannot access the network. And after the source address in the network data is known to be not matched with the verification source address, the packet interception protection can be carried out.
According to the network data auditing method, if the network data of the access equipment is acquired, N groups of data to be verified are extracted from the network data; and auditing the incidence relation between each key information and all key information in each group of data to be verified respectively based on a pre-constructed audit model, and protecting the network under the condition that the obtained audit result indicates failure, so that the network is protected based on the audit result after a plurality of data are verified. By adopting the technical scheme of the invention, the accuracy of the audit result of the network data can be improved, the occurrence of network security events can be reduced, and the network security can be further improved.
Further, in the above embodiment, if the obtained audit result indicates that the audit result fails, the user may be traced back according to the user identifier, and/or the use information of the access device may be traced back according to the access device identifier. Thus, when an attacker is found, the use information and the like of the attacker and/or the anti-counterfeiting equipment used by the attacker can be traced, and finally the attacker can be followed.
In practical application, if more than 2 groups of data to be verified exist, a long time is consumed when the incidence relation between the key information in each group of verification data and all the key information is checked, and because a group of data to be verified can achieve a good protection effect, in this implementation, a group of data to be verified can be randomly selected, and the incidence relation between the key information in the selected data to be verified and all the key information can be audited. However, if the security level of the network to be protected is high, although a group of data to be verified is randomly selected and the association relationship between the key information in the selected data to be verified and all the key information is audited to achieve a good protection effect, the present invention still has a large potential safety hazard.
Fig. 2 is a flowchart of a second embodiment of the network data auditing method of the present invention, and referring to fig. 2, the network data auditing method of the present embodiment further describes the technical solution of the present invention in more detail on the basis of the above embodiment, and the network data auditing method implemented in the present embodiment may specifically include the following steps:
200. if the network data of the access equipment is acquired, extracting N groups of data to be verified from the network data;
201. if N is greater than or equal to 2, determining the security level of the network;
wherein the security level of the network is preset, or the security level of the network is determined according to the number of N.
For example, the user may set the security level of the network according to actual needs. If the user does not set the security level of the network, the security level of the network can be determined according to the number of groups of data to be verified set by the user, for example, if 1 group or 2 groups are set, it can be determined that the security level of the network is relatively low, and a lower level value can be obtained at this time, and if 3 groups or more are set, it indicates that the security level of the network is higher, and a lower level value can be obtained.
202. Determining the number of groups of selected data to be verified according to the security level of the network;
specifically, if the security level of the network is less than a preset level, a group of data to be verified is randomly selected; and if the network security level is greater than or equal to the preset level, at least two groups of data to be verified are randomly selected. Therefore, when the security level of the network is low, the preferred auditing efficiency is the main, at the moment, a group of data to be verified can be randomly selected, when the security level of the network is high, the preferred auditing result accuracy is the main, at the moment, at least two groups of data to be verified can be randomly selected, wherein the preferred selection is that the number of the groups of the data to be verified is increased along with the increase of the security level value, and therefore the auditing efficiency can be considered simultaneously.
203. Auditing the incidence relation of each key information and all key information respectively based on a pre-constructed audit model to obtain an audit result;
204. and if the obtained audit result indicates that the network fails, protecting the network.
It should be noted that the method of the embodiment of the present invention may be executed by a single device, such as a computer or a server. The method of the embodiment can also be applied to a distributed scene and completed by the mutual cooperation of a plurality of devices. In the case of such a distributed scenario, one of the multiple devices may only perform one or more steps of the method according to the embodiment of the present invention, and the multiple devices interact with each other to complete the method.
In order to solve the technical problems in the prior art, an embodiment of the present invention provides a network data auditing apparatus.
Fig. 3 is a schematic structural diagram of a first embodiment of the network data auditing apparatus of the present invention, and as shown in fig. 3, the network data auditing apparatus of the present embodiment includes anextraction module 30, anauditing module 31, and aprotection module 32.
The extractingmodule 30 is configured to obtain network data of the access device, and extract N groups of data to be verified from the network data; each group of data to be verified comprises at least two pieces of key information and the incidence relation of all the key information, each group of data to be verified is different, and each piece of key information in each group of data to be verified is different; n is a positive integer;
theauditing module 31 is used for auditing each key information and the association relation respectively based on a pre-constructed auditing model;
in this embodiment, the process of constructing the audit model includes: processing the original information corresponding to each individual verification information to obtain processing information with uniqueness and/or anti-counterfeiting property as individual verification information; and performing association processing on all the individual verification information to obtain associated verification information. For example, a binding process is performed between all the individual authentication information, and/or an embedding process is performed between all the individual authentication information. When all the individual verification information is subjected to embedding processing, all the individual verification information can be subjected to embedding processing in a plaintext and/or ciphertext mode.
After the obtaining module extracts at least one group of data to be verified in the network data, theauditing module 31 may compare each piece of key information with the preset individual verification information in the auditing model to obtain a first comparison result, and compare the key information with the preset associated verification information in the auditing model to obtain a second comparison result; if the first comparison result and the second comparison result both represent matching, obtaining an audit result representing passing; and if the first comparison result and/or the second comparison result show no match, obtaining an audit result showing failure.
And theprotection module 32 is used for protecting the network if the audit result shows that the audit result does not pass.
In the network data auditing device of the embodiment, if the network data of the access equipment is acquired, N groups of data to be verified are extracted from the network data; and auditing the incidence relation between each key information and all key information in each group of data to be verified respectively based on a pre-constructed audit model, and protecting the network under the condition that the obtained audit result indicates failure, so that the network is protected based on the audit result after a plurality of data are verified. By adopting the technical scheme of the invention, the accuracy of the audit result of the network data can be improved, the occurrence of network security events can be reduced, and the network security can be further improved.
Further, in the above embodiment, theprotection module 32 is further configured to trace back the user according to the user identifier and/or trace back the use information of the access device according to the access device identifier if the obtained audit result indicates that the audit result fails. Thus, when an attacker is found, the use information and the like of the attacker and/or the anti-counterfeiting equipment used by the attacker can be traced, and finally the attacker can be followed.
Fig. 4 is a schematic structural diagram of a second embodiment of the network data auditing apparatus according to the present invention, and as shown in fig. 4, the network data auditing apparatus according to the present embodiment may further include a determiningmodule 33 based on the above-mentioned embodiment.
A determiningmodule 33, configured to determine a security level of the network if N is greater than or equal to 2; and determining the number of groups of the selected data to be verified according to the security level of the network.
Specifically, the security level of the network is preset, or the security level of the network is determined according to N. If the security level of the network is less than the preset level, randomly selecting a group of data to be verified; and if the network security level is greater than or equal to the preset level, at least two groups of data to be verified are randomly selected.
The apparatus of the foregoing embodiment is used to implement the corresponding method in the foregoing embodiment, and has the beneficial effects of the corresponding method embodiment, which are not described herein again.
In order to solve the technical problems in the prior art, an embodiment of the present invention provides a network data auditing apparatus.
Fig. 5 is a schematic structural diagram of an embodiment of the network data auditing apparatus according to the present invention, and as shown in fig. 5, the network data auditing apparatus according to the embodiment of the present invention includes astorage medium 51 and aprocessor 50, where thestorage medium 51 stores a computer program, and the computer program implements the steps of the method when executed by theprocessor 50.
In order to solve the above technical problems in the prior art, embodiments of the present invention provide a storage medium.
The storage medium provided by the embodiment of the invention stores a computer program thereon, and the computer program realizes the steps of the method when being executed by a processor.
It is understood that the same or similar parts in the above embodiments may be mutually referred to, and the same or similar parts in other embodiments may be referred to for the content which is not described in detail in some embodiments.
It should be noted that the terms "first," "second," and the like in the description of the present invention are used for descriptive purposes only and are not to be construed as indicating or implying relative importance. Further, in the description of the present invention, the meaning of "a plurality" means at least two unless otherwise specified.
Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps of the process, and alternate implementations are included within the scope of the preferred embodiment of the present invention in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the present invention.
It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.
In addition, functional units in the embodiments of the present invention may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.
The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
Although the embodiments of the present invention have been described above, the above description is only for the convenience of understanding the present invention, and is not intended to limit the present invention. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims (10)

Translated fromChinese
1.一种网络数据审计方法,其特征在于,包括以下步骤:1. a network data auditing method, is characterized in that, comprises the following steps:若获取到访问设备的网络数据,从所述网络数据中提取N组需验证数据;其中,每组所述需验证数据包括至少两个关键信息和所有关键信息的关联关系,每组所述需验证数据不同,且每组所述需验证数据中的每个关键信息不同;所述N为正整数;所述N组需验证数据中的一组需验证数据包括两个所述关键信息,第一个关键信息为身份标识,第二个关键信息为源地址;所述身份标识包括用户标识和/或访问设备标识;If the network data of the access device is obtained, N groups of data to be verified are extracted from the network data; wherein, each group of the data to be verified includes at least two key information and the association relationship of all key information, and each group of the required verification data The verification data is different, and each key information in each group of the data to be verified is different; the N is a positive integer; a group of the data to be verified in the N groups of data to be verified includes two of the key information, the first One key information is an identity identifier, and the second key information is a source address; the identity identifier includes a user identifier and/or an access device identifier;基于预先构建的审计模型,分别对每个所述关键信息和所述关联关系进行审计,得到审计结果;Based on a pre-built audit model, audit each of the key information and the associated relationship, respectively, to obtain an audit result;若所述审计结果表示未通过,对网络进行保护。If the audit result indicates failure, the network is protected.2.根据权利要求1所述的方法,其特征在于,所述基于预先构建的审计模型,分别对每个所述关键信息和所述关联关系进行审计,得到审计结果,包括:2. The method according to claim 1, wherein, based on a pre-built audit model, each of the key information and the associated relationship is audited respectively to obtain an audit result, comprising:将每个所述关键信息与所述审计模型中预设的单独验证信息进行比对,得到第一比对结果,以及,将所述关键信息与所述审计模型中预设的关联验证信息进行比对,得到第二比对结果;Comparing each of the key information with the individual verification information preset in the audit model to obtain a first comparison result, and comparing the key information with the associated verification information preset in the audit model Compare to obtain a second alignment result;若所述第一比对结果和所述第二比对结果均表示匹配,得到表示通过的审计结果;If both the first comparison result and the second comparison result indicate a match, an audit result indicating passing is obtained;若所述第一比对结果和/或所述第二比对结果表示不匹配,得到表示未通过的审计结果。If the first comparison result and/or the second comparison result indicates a mismatch, an audit result indicating a failure is obtained.3.根据权利要求2所述的方法,其特征在于,所述单独验证信息包括验证身份标识或验证源地址;所述验证身份标识包括用户验证标识和/或访问设备验证标识。3 . The method according to claim 2 , wherein the independent verification information comprises a verification identity or a verification source address; and the verification identity comprises a user verification mark and/or an access device verification mark. 4 .4.根据权利要求3所述的方法,其特征在于,还包括:4. The method of claim 3, further comprising:若所述审计结果表示未通过,根据所述用户标识追溯用户,和/或,根据所述访问设备标识追溯访问设备的使用信息。If the audit result indicates failure, the user is traced back according to the user ID, and/or the usage information of the access device is traced back according to the access device ID.5.根据权利要求2至4中任一项所述的方法,其特征在于,所述审计模型的构建过程包括:5. The method according to any one of claims 2 to 4, wherein the construction process of the audit model comprises:对每个所述单独验证信息对应的原始信息进行处理,得到具有唯一性和/或防伪性的处理信息作为所述单独验证信息;processing the original information corresponding to each of the individual verification information to obtain unique and/or anti-counterfeiting processing information as the individual verification information;将所有所述单独验证信息进行关联处理,得到所述关联验证信息。All the individual verification information is associated with each other to obtain the associated verification information.6.根据权利要求5所述的方法,其特征在于,将所有所述单独验证信息进行关联处理,包括:6. The method according to claim 5, characterized in that, performing association processing on all the individual verification information, comprising:将所有所述单独验证信息之间进行绑定处理,和/或,将所有所述单独验证信息之间采用明文和/或密文的方式进行嵌入处理。Binding processing is performed between all the individual verification information, and/or embedding processing is performed between all the individual verification information in the manner of plaintext and/or ciphertext.7.根据权利要求1所述的方法,其特征在于,所述基于预先构建的审计模型,分别对每个所述关键信息和/或所述关联关系进行审计,得到审计结果之前,还包括:7. The method according to claim 1, characterized in that, based on a pre-built audit model, auditing each of the key information and/or the associated relationship respectively, before obtaining an audit result, further comprising:若所述N大于或等于2,确定所述网络的安全等级;If the N is greater than or equal to 2, determine the security level of the network;根据所述网络的安全等级,确定选取所述需验证数据的组数。According to the security level of the network, the number of groups to select the data to be verified is determined.8.根据权利要求7所述的方法,其特征在于,所述网络的安全等级为预设的,或者,所述网络的安全等级为根据所述N确定的。8 . The method according to claim 7 , wherein the security level of the network is preset, or the security level of the network is determined according to the N. 9 .9.根据权利要求7所述的方法,其特征在于,所述根据所述网络的安全等级,确定选取所述需验证数据的组数,包括:9. The method according to claim 7, wherein, according to the security level of the network, determining to select the group number of the data to be verified, comprising:若所述网络的安全等级小于预设等级,随机选取一组需验证数据;If the security level of the network is less than the preset level, randomly select a group of data to be verified;若所述网络安全等级大于或者等于所述预设等级,随机选取至少两组需验证数据。If the network security level is greater than or equal to the preset level, at least two sets of data to be verified are randomly selected.10.一种网络数据审计装置,其特征在于,包括:10. A network data auditing device, comprising:提取模块,用于若获取到访问设备的网络数据,从所述网络数据中提取N组需验证数据;其中,每组所述需验证数据包括至少两个关键信息和所有关键信息的关联关系,每组所述需验证数据不同,且每组所述需验证数据中的每个关键信息不同;所述N为正整数;所述N组需验证数据中的一组需验证数据包括两个所述关键信息,第一个关键信息为身份标识,第二个关键信息为源地址;所述身份标识包括用户标识和/或访问设备标识;The extraction module is used to extract N groups of data to be verified from the network data if the network data of the access device is obtained; wherein, each group of the data to be verified includes at least two key information and the association relationship of all key information, The data to be verified in each group is different, and each key information in the data to be verified in each group is different; the N is a positive integer; one set of the data to be verified in the N groups of data to be verified includes two Describe the key information, the first key information is an identity identifier, and the second key information is a source address; the identity identifier includes a user identifier and/or an access device identifier;审计模块,用于基于预先构建的审计模型,分别对每个所述关键信息和所述关联关系进行审计,得到审计结果;an audit module, configured to audit each of the key information and the association relationship based on a pre-built audit model, to obtain an audit result;保护模块,用于若所述审计结果表示未通过,对网络进行保护。The protection module is used to protect the network if the audit result indicates that the audit fails.
CN202010145311.2A2020-03-042020-03-04 Network data auditing method and deviceActiveCN111404888B (en)

Priority Applications (1)

Application NumberPriority DateFiling DateTitle
CN202010145311.2ACN111404888B (en)2020-03-042020-03-04 Network data auditing method and device

Applications Claiming Priority (1)

Application NumberPriority DateFiling DateTitle
CN202010145311.2ACN111404888B (en)2020-03-042020-03-04 Network data auditing method and device

Publications (2)

Publication NumberPublication Date
CN111404888A CN111404888A (en)2020-07-10
CN111404888Btrue CN111404888B (en)2021-04-20

Family

ID=71430497

Family Applications (1)

Application NumberTitlePriority DateFiling Date
CN202010145311.2AActiveCN111404888B (en)2020-03-042020-03-04 Network data auditing method and device

Country Status (1)

CountryLink
CN (1)CN111404888B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN114676222B (en)*2022-03-292022-12-02北京国信网联科技有限公司Method for quickly auditing in-out internal network data

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
US9077644B2 (en)*2010-12-082015-07-07At&T Intellectual Property I, L.P.Methods and apparatus for communicating with groups of devices sharing an attribute
CN102014142B (en)*2010-12-312013-01-30中国科学院计算技术研究所 A source address verification method and system
CN104253798A (en)*2013-06-272014-12-31中兴通讯股份有限公司Network security monitoring method and system
CN104426884A (en)*2013-09-032015-03-18深圳市腾讯计算机系统有限公司Method for authenticating identity and device for authenticating identity
WO2016181585A1 (en)*2015-05-082016-11-17パナソニックIpマネジメント株式会社Authentication method, authentication system, and controller
CN108574723A (en)*2017-12-122018-09-25高榕科技(深圳)有限公司It limits the verification method of user group and realizes the private cloud storage system of this method
CN108769073B (en)*2018-07-042021-06-25中国人民解放军战略支援部队信息工程大学 An information processing method and device

Also Published As

Publication numberPublication date
CN111404888A (en)2020-07-10

Similar Documents

PublicationPublication DateTitle
Tian et al.Dynamic-hash-table based public auditing for secure cloud storage
US11151259B2 (en)Method and system for data security, validation, verification and provenance within independent computer systems and digital networks
JP6703539B2 (en) Device verification method and device
CN103401957B (en)A kind of unique method identifying client machine under web environment
TWI587672B (en) Login authentication method, client, server and system
CN111464503B (en) Network dynamic defense method, device and system based on random multi-dimensional transformation
CN1889432A (en)Long-distance password identifying method based on smart card, smart card, server and system
CN101894238A (en) Word document electronic seal system and method based on double authentication
CN102739774B (en)Method and system for obtaining evidence under cloud computing environment
CN103077345B (en)Based on software authorization method and the system of virtual machine
WO2011121928A1 (en)Digital content management system, verification device, programs therefor, and data processing method
CN102231729A (en)Method for supporting various CA (Certification Authority) identity authentications
CN111191194B (en)Off-line use permission system for multi-core processor software integrated development environment
Karnwal et al.A filter tree approach to protect cloud computing against XML DDoS and HTTP DDoS attack
CN108260015B (en)Voting data processing method and device and electronic equipment
CN110837634A (en)Electronic signature method based on hardware encryption machine
CN111404888B (en) Network data auditing method and device
CN116781332A (en)Block chain-based network flow evidence obtaining and tracing method and system
Tu et al.Privacy‐Preserving Outsourced Auditing Scheme for Dynamic Data Storage in Cloud
CN115834035A (en) Multimedia data storage method, computer equipment and storage device
CN118282663B (en) A first impression-based anti-disguise identity authentication method in the metaverse
CN107730432B (en) Image processing method and application server
CN110049054B (en) Plaintext shared data auditing method and system supporting privacy information hiding
CN101355428A (en) A Method for Protecting Data Integrity Using Incremental Verification
Liu et al.Secure streaming forensic data transmission for trusted cloud

Legal Events

DateCodeTitleDescription
PB01Publication
PB01Publication
SE01Entry into force of request for substantive examination
SE01Entry into force of request for substantive examination
GR01Patent grant
GR01Patent grant

[8]ページ先頭

©2009-2025 Movatter.jp