CN111541653B - Data communication monitoring system and method - Google Patents

Abstract

The invention provides a data communication monitoring system and a method, comprising the following steps: the system comprises an administrator authority identification unit, a communication authority setting unit, an abnormal data identification unit and a flow monitoring unit. The invention ensures the use safety of the system by identifying the authority of the system administrator; when the client uses the data communication network, the abnormal information in the data stream sent by the client is identified in real time, and after the identification is successful, the communication authority of the corresponding client is closed or the flow monitoring unit is used for limiting the flow of the corresponding client, so that the user experience is ensured, and meanwhile, the safety of the communication network is effectively guaranteed.

Description

A data communication monitoring system and method

technical field

The present invention relates to the technical field of electronic communication, and more specifically relates to a data communication monitoring system and method.

Background technique

Data communication is a form of communication that integrates data processing and transmission, realizes the reception, storage, processing and transmission of digital information, and controls, verifies and manages information flow. With the continuous development of data communication networks, more and more communication devices have been applied in industry and daily life, greatly facilitating people's work and life.

With the wide application of data communication, the security problem of data communication is also becoming more and more obvious. For the existing data communication network, there are often malicious attacks and damages initiated by illegal personnel, such as sending some abnormal data continuously, maliciously occupying network traffic, or sending some data with illegal information from time to time , causing it to propagate across the network. Therefore, how to strengthen the monitoring of the data communication network, effectively discover and control the above-mentioned malicious behaviors, so as to ensure the security of data communication is an urgent problem to be solved.

Contents of the invention

In view of the above problems, the purpose of the present invention is to provide a data communication monitoring system and method, which can effectively discover and monitor malicious data, thereby ensuring the security of data communication.

In order to achieve the above object, the present invention is achieved through the following technical solutions: a data communication monitoring system, comprising: an administrator authority identification unit, a communication authority setting unit, an abnormal data identification unit and a flow monitoring unit;

The administrator authority identification unit is used to identify the identity of the system administrator and open the corresponding authority level to the administrator;

The communication authority setting unit is used to set the communication network usage authority of the client;

The abnormal data identification unit is used to identify the abnormal information in the data stream sent by the client. After the identification is successful, the communication authority of the corresponding client is prohibited through the communication authority setting unit or the corresponding client is limited through the traffic monitoring unit;

The flow monitoring unit is used to monitor the data flow of the client and perform data flow control.

Further, a threshold alarm unit is also included,

The threshold alarm unit is configured to issue an alarm message when the traffic monitoring unit detects that the data traffic of the client exceeds a preset threshold.

Further, it also includes a wireless communication unit, the wireless communication unit includes a SIM card slot and a SIM card communication module, the SIM card slot and the SIM card communication module are connected through a SIM card communication circuit, and after the SIM is installed in the SIM card slot, it is used for Send communication monitoring data or alarm information to the administrator's handheld communication terminal through the GSM network.

Further, the administrator authority authentication unit includes: an input module, a storage module, a comparison module and an authority opening module;

The input module is used to input the administrator's identity information and identity verification code;

The storage module is used to store administrator identity information, corresponding identity verification codes and authority levels;

The identity information and the identity verification code of the administrator who is used for multi-input by the comparison module are compared with the identity information and the identity verification code in the storage module, and the corresponding authority level is locked after the comparison is successful;

The authority opening module is used to open the authority level of the administrator according to the authority information.

Further, the abnormal data identification unit includes:

A data warehouse, wherein a preset abnormal data set is stored in the data warehouse;

The model building module is used to establish an abnormal data model for preset abnormal data by adopting a neural network-based modeling algorithm;

The data queue building module is used to read the data flow sent by the client and establish the data queue of the data flow;

The identification module is used to load the abnormal data model and match the data flow with the abnormal data model one by one according to the data queue, and record the client corresponding to the data flow after the matching is completed.

Further, the abnormal data identification unit also includes:

The analysis module is used to perform statistics on the client data matched by the identification module in batch processing to obtain the data size, proportion of abnormal information, and intensity of sensitive information, and obtain the abnormal level of the client according to the preset evaluation standard.

Further, the communication authority setting unit is also used to close the communication network usage authority of the client when the abnormal level of the client reaches the first preset level; the traffic monitoring unit is also used to close the communication network usage authority of the client when the abnormal level of the client reaches the second preset After leveling, modify the TCP connection limit parameter of the client, and the number of TCP connections of the client within the preset time interval is not greater than the TCP connection limit parameter.

Correspondingly, the present invention also discloses a data communication monitoring method, including the following steps:

S1: Identify the identity of the system administrator, and open the corresponding authority level to the administrator;

S2: Read the data stream sent by the client, and identify abnormal information in the data stream;

S3: After the identification is successful, the client's communication authority is prohibited or the current is limited, and the processing result is generated;

S4: Send the processing result to the administrator's handheld communication terminal through the GSM network.

Further, the step S2 specifically includes:

S21: Read the data flow sent by the client, and establish a data queue for the data flow;

S22: Load the abnormal data model and match the data flow with the abnormal data model one by one according to the data queue, and record the client corresponding to the data flow after the matching is completed;

S23: Use batch processing to count the client data matched by the identification module, obtain the data size, abnormal information ratio, and sensitive information intensity, and obtain the abnormal level of the client according to the preset evaluation standard.

Further, the step S3 specifically includes:

When the abnormality level of the client reaches the first preset level, close the communication network usage authority of the client; it is used to modify the TCP connection limit parameters of the client when the abnormality level of the client reaches the second preset level, so that the client is in the preset The number of TCP connections in the time interval is not greater than the TCP connection limit parameter.

Compared with the prior art, the beneficial effects of the present invention are: the present invention provides a data communication monitoring system and method, which ensures the safety of the system by identifying the authority of the system administrator; when the client uses the data communication network, real-time Identify abnormal information in the data stream sent by the client. After successful identification, close the communication authority of the corresponding client or limit the flow of the corresponding client through the traffic monitoring unit. While ensuring the user experience, the communication network is effectively guaranteed. Safety. In addition, the present invention also has a wireless communication unit, which can communicate with the administrator's hand-held communication terminal through the GSM network, and then can send threshold alarms and corresponding communication data to the administrator.

It can be seen that, compared with the prior art, the present invention has outstanding substantive features and remarkable progress, and the beneficial effects of its implementation are also obvious.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Accompanying drawing 1 is a system structure diagram of Embodiment 1 of the present invention.

Accompanying drawing 2 is the method flowchart of embodiment 2 of the present invention.

Accompanying drawing 3 is the method flowchart of embodiment 3 of the present invention.

Detailed ways

Specific embodiments of the present invention will be described below in conjunction with the accompanying drawings.

Embodiment one:

As shown in Figure 1, a data communication monitoring system includes: an administrator authority identification unit, a communication authority setting unit, an abnormal data identification unit, a flow monitoring unit, a threshold alarm unit and a wireless communication unit;

The administrator authority identification unit is used to identify the identity of the system administrator and open the corresponding authority level to the administrator. The administrator authority authentication unit includes: an input module, a storage module, a comparison module and an authority opening module; the input module is used to input the administrator's identity information and identity verification code; the storage module is used to store the administrator's identity information , corresponding identity verification code and authority level; the identity information and identity verification code of the administrator who is used for multi-input by the comparison module are compared with the identity information and the identity verification code in the storage module, and the comparison is successful Then lock the corresponding authority level; the authority opening module is used to open the authority level of the administrator according to the authority information.

The communication authority setting unit is used to set the communication network usage authority of the client.

The abnormal data identification unit is used to identify the abnormal information in the data stream sent by the client. After the identification is successful, the communication authority of the corresponding client is prohibited through the communication authority setting unit or the corresponding client is limited through the traffic monitoring unit;

The flow monitoring unit is used to monitor the data flow of the client and perform data flow control.

The threshold alarm unit is configured to issue an alarm message when the traffic monitoring unit detects that the data traffic of the client exceeds a preset threshold.

The wireless communication unit includes a SIM card slot and a SIM card communication module, and the SIM card slot and the SIM card communication module are connected through a SIM card communication circuit. After installing a SIM in the SIM card slot, it is used to pass communication monitoring data or alarm information GSM network sent to the administrator's handheld communication terminal.

Among them, the abnormal data identification unit includes:

A data warehouse, wherein a preset abnormal data set is stored in the data warehouse.

The model building module is used for establishing an abnormal data model for preset abnormal data by adopting a neural network-based modeling algorithm.

The data queue building module is used to read the data flow sent by the client and build a data queue of the data flow.

The identification module is used to load the abnormal data model and match the data flow with the abnormal data model one by one according to the data queue, and record the client corresponding to the data flow after the matching is completed.

The analysis module is used to perform statistics on the client data matched by the identification module in batch processing to obtain the data size, proportion of abnormal information, and intensity of sensitive information, and obtain the abnormal level of the client according to the preset evaluation standard.

When the abnormal level of the client reaches the first preset level, the communication authority setting unit closes the communication network usage authority of the client. The client is prohibited from using the communication network within a certain period of time. When the abnormal level of the client reaches the second preset level, the traffic monitoring unit modifies the TCP connection limit parameter of the client, and the number of TCP connections of the client within the preset time interval is not greater than the TCP connection limit parameter. Once the TCP connection limit parameter is exceeded, the client is prohibited from re-TCP connection within a certain period of time. When the number of TCP connections decreases below the TCP connection limit parameter, the connection is opened.

Embodiment two:

Correspondingly, as shown in Figure 2, the present invention also discloses a data communication monitoring method, including the following steps:

S201: Identify the identity of the system administrator, and open the corresponding authority level to the administrator.

S202: Read the data stream sent by the client, and identify abnormal information in the data stream.

S203: After the identification is successful, the communication authority of the client is prohibited or the flow is limited, and a processing result is generated.

S204: Send the processing result to the administrator's handheld communication terminal through the GSM network.

Embodiment three:

On the basis of the above embodiments, as shown in Figure 3, this embodiment also discloses a data communication monitoring method, including the following steps:

S301: Identify the identity of the system administrator, and open the corresponding authority level to the administrator.

S302: Read the data flow sent by the client, and establish a data queue of the data flow.

S303: Load the abnormal data model and match the data flow with the abnormal data model one by one according to the data queue, and record the client corresponding to the data flow after the matching is completed.

S304: Use batch processing to count the client data matched by the identification module, obtain the data size, abnormal information ratio, and sensitive information intensity, and obtain the abnormal level of the client according to the preset evaluation standard.

S305: When the abnormality level of the client reaches the first preset level, close the communication network usage authority of the client; when the abnormality level of the client reaches the second preset level, modify the TCP connection limit parameter of the client so that the client is at the preset The number of TCP connections in the time interval is not greater than the TCP connection limit parameter.

S306: Send the communication monitoring process data and alarm information to the administrator's handheld communication terminal through the GSM network.

In the several embodiments provided by the present invention, it should be understood that the disclosed system, system and method can be implemented in other ways. For example, the system embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of systems or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may physically exist separately, or two or more modules may be integrated into one unit.

Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

The present invention will be further described in conjunction with the accompanying drawings and specific embodiments. It should be understood that these examples are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art may make various changes or modifications to the present invention, and these equivalent forms also fall within the scope defined in the present application.

Claims (7)

1. A data communication monitoring system, characterized in that, comprising: an administrator authority identification unit, a communication authority setting unit, an abnormal data identification unit and a traffic monitoring unit; The administrator authority identification unit is used to identify the identity of the system administrator and open the corresponding authority level to the administrator; The communication authority setting unit is used to set the communication network usage authority of the client; The abnormal data identification unit is used to identify the abnormal information in the data stream sent by the client. After the identification is successful, the communication authority of the corresponding client is prohibited through the communication authority setting unit or the corresponding client is limited through the traffic monitoring unit; The flow monitoring unit is used to monitor the data flow of the client and perform data flow control; The abnormal data identification unit includes: A data warehouse, wherein a preset abnormal data set is stored in the data warehouse; The model building module is used to establish an abnormal data model for preset abnormal data by adopting a neural network-based modeling algorithm; The data queue building module is used to read the data flow sent by the client and establish the data queue of the data flow; The identification module is used to load the abnormal data model and match the data flow with the abnormal data model one by one according to the data queue, and record the client corresponding to the data flow after the matching is completed; The abnormal data identification unit also includes: The analysis module is used to perform statistics on the client data matched by the identification module in a batch processing manner, obtain the data size, abnormal information ratio, and sensitive information intensity, and obtain the abnormal level of the client according to the preset evaluation standard; The communication authority setting unit is also used to close the communication network usage authority of the client when the abnormal level of the client reaches the first preset level; , modifying the TCP connection limit parameter of the client, the number of TCP connections of the client within the preset time interval is not greater than the TCP connection limit parameter. 2. The data communication monitoring system according to claim 1, further comprising a threshold alarm unit, The threshold alarm unit is configured to issue an alarm message when the traffic monitoring unit detects that the data traffic of the client exceeds a preset threshold. 3. according to claim 1 or 2 described data communication monitoring systems, it is characterized in that, also comprise wireless communication unit, described wireless communication unit comprises SIM card groove and SIM card communication module, SIM card groove and SIM card communication module pass through The SIM card communication circuit is connected, and after the SIM card is installed in the SIM card slot, it is used to send communication monitoring data or alarm information to the administrator's handheld communication terminal through the GSM network. 4. The data communication monitoring system according to claim 1, wherein the administrator authority authentication unit comprises: an input module, a storage module, a comparison module and an authority opening module; The input module is used to input the administrator's identity information and identity verification code; The storage module is used to store administrator identity information, corresponding identity verification codes and authority levels; The comparison module is used to compare the input administrator's identity information and identity verification code with the identity information and identity verification code in the storage module, and lock the corresponding authority level after the comparison is successful; The authority opening module is used to open the authority level of the administrator according to the authority information. 5. A data communication monitoring method, characterized in that the method adopts the data communication monitoring system according to any one of claims 1 to 4, comprising the following steps: S1: Identify the identity of the system administrator, and open the corresponding authority level to the administrator; S2: Read the data stream sent by the client, and identify abnormal information in the data stream; S3: After the identification is successful, the client's communication authority is prohibited or the current is limited, and the processing result is generated; S4: Send the processing result to the administrator's handheld communication terminal through the GSM network. 6. The data communication monitoring method according to claim 5, wherein said step S2 specifically comprises: S21: Read the data flow sent by the client, and establish a data queue for the data flow; S22: Load the abnormal data model and match the data flow with the abnormal data model one by one according to the data queue, and record the client corresponding to the data flow after the matching is completed; S23: Use batch processing to count the client data matched by the identification module, obtain the data size, abnormal information ratio, and sensitive information intensity, and obtain the abnormal level of the client according to the preset evaluation standard. 7. The data communication monitoring method according to claim 6, wherein said step S3 specifically comprises: When the abnormality level of the client reaches the first preset level, close the communication network usage authority of the client; when the abnormality level of the client reaches the second preset level, modify the TCP connection limit parameters of the client so that the client will be in the preset time interval The number of TCP connections within is not greater than the TCP connection limit parameter.

Images