CN113132372B - Method, system, storage medium and computer equipment for security monitoring of networked equipment of router - Google Patents

Abstract

The invention is suitable for the technical field of routers, and provides a security monitoring method for networking equipment of a router, which comprises the following steps: acquiring network traffic generated through router networking; analyzing and judging whether the network flow is matched with any preset rule or not; the preset rule is an information matching rule of a corresponding security event which is preset; if the network traffic is matched with the preset rule, generating a prompt message that the network traffic is from the corresponding security event; and sending the prompt message to a corresponding authorized user. A networked device security monitoring system of a router, a storage medium for storing a computer program for executing the method and a computer device for realizing the method are also provided. Therefore, the invention can improve the identification of the security event networked through the wireless local area network and enhance the security performance of the home network.

Description

Networked device security monitoring method, system, storage medium and computer of router equipment

technical field

The invention relates to the technical field of routers, in particular to a security monitoring method, system, storage medium and computer equipment for networked equipment of routers.

Background technique

With the maturity of smart home appliance technology, people use more and more smart devices in their daily life, and most of the smart devices are connected to the wireless local area network for networking.

As a gateway device in the home, although the router can obtain the network traffic of all smart devices in the home, it lacks effective identification of security events related to the daily use of smart devices; for example, a smart door lock is opened in the middle of the night or Existing routers are not able to provide effective identification of specific security events such as being turned on during user travel.

To sum up, it can be seen that there are many problems in the actual use of the existing methods, so it is necessary to improve them.

Contents of the invention

In view of the above-mentioned defects, the object of the present invention is to provide a router networked device security monitoring method, system, storage medium and computer equipment thereof, which can improve the identification of security events connected through the wireless local area network, and enhance the security performance of the home network.

In order to achieve the above object, the present invention provides a security monitoring method for a networked device of a router, comprising steps:

Obtain network traffic generated via router networking;

Analyzing and judging whether the network traffic matches any preset preset rule; wherein, the preset rule is an information matching rule corresponding to a pre-occurrence of a security event;

If it matches the preset rule, generate a prompt message that the network traffic originates from the corresponding security event;

The prompt message is sent to the corresponding authorized user.

Optionally, the step of analyzing and judging whether the network traffic matches any preset rule specifically includes:

Analyzing and obtaining the networked device corresponding to the network traffic, traffic generation time, and traffic characteristics;

Judging whether the networked device, the traffic generation time, and the traffic characteristics all match the preset rule.

Optionally, the step of analyzing and obtaining the networked device corresponding to the network traffic, traffic generation time, and traffic characteristics specifically includes:

Extracting the mac address (Media Access Control Address, LAN address) corresponding to the network traffic, and identifying the corresponding networked device according to the mac address;

According to the network request corresponding to the network traffic, the traffic generation time and the traffic characteristics of the network traffic are analyzed and obtained.

Optionally, the step of sending the prompt message to the corresponding authorized user specifically includes:

The server receives the prompt message uploaded by the router, and forwards the prompt message to the mobile terminal of the authorized user corresponding to the router.

Optionally, before the step of analyzing and judging whether the network traffic matches any preset rule, the step further includes:

In response to the security monitoring function activated by the router, at least one of the preset rules is downloaded to the router.

Optionally, before the step of analyzing and judging whether the network traffic matches any preset rule, the step further includes:

The preset rule corresponding to the security event is configured according to the pre-occurring behavior characteristics of the security event.

Optionally, the step of configuring the preset rule corresponding to the security event according to the pre-occurring network traffic characteristics of the security event specifically includes:

Prefabricating the network behavior that occurs in advance of the security event, and analyzing the behavioral characteristics of the network behavior;

The preset rules corresponding to the security events are configured according to the behavior characteristics.

Optionally, after the step of sending the prompt message to the corresponding authorized user, it further includes:

The network traffic is intercepted according to the interception instruction triggered by the authorized user.

Also provided is a networked device security monitoring system for routers, including:

an acquisition unit, configured to acquire network traffic generated via router networking;

An analysis and judgment unit, configured to analyze and judge whether the network traffic matches any preset preset rule; wherein, the preset rule is an information matching rule corresponding to a pre-occurrence of a security event;

a generating unit, configured to generate a prompt message that the network traffic originates from the corresponding security event if it matches the preset rule;

A sending unit, configured to send the prompt message to a corresponding authorized user.

Optionally, the analysis and judgment unit specifically includes:

An analysis subunit, configured to analyze and obtain the networked device corresponding to the network traffic, traffic generation time, and traffic characteristics;

A judging subunit, configured to judge whether the networked device, the traffic generation time, and the traffic characteristics all match the preset rule.

Optionally, the analysis subunit is specifically used for:

Extracting the mac address corresponding to the network traffic, and identifying the corresponding networked device according to the mac address;

According to the network request corresponding to the network traffic, the traffic generation time and the traffic characteristics of the network traffic are analyzed and obtained.

Optionally, the sending unit is specifically used for:

The server receives the prompt message uploaded by the router, and forwards the prompt message to the mobile terminal of the authorized user corresponding to the router.

Optionally, also include:

The rule downloading unit is configured to download at least one of the preset rules into the router in response to the security monitoring function activated by the router.

Optionally, also include:

A rule configuration unit configured to configure the preset rule corresponding to the security event according to the pre-occurring behavior characteristics of the security event.

Optionally, the rule configuration unit specifically includes:

An analysis sub-unit is used to prefabricate the network behavior that occurs in advance of the security event, and analyze the behavior characteristics of the network behavior;

The configuration subunit is configured to configure the preset rule corresponding to the security event according to the behavior feature.

Optionally, also include:

An intercepting unit, configured to intercept the network traffic according to the interception instruction triggered by the authorized user.

In addition, a storage medium and computer equipment are also provided, and the storage medium is used for storing a computer program for executing the above-mentioned security monitoring method for a networked equipment of a router.

The computer device includes a storage medium, a processor, and a computer program stored on the storage medium and operable on the processor. When the processor executes the computer program, the above-mentioned networked device security monitoring of the router is realized. method.

The security monitoring method and system for networked equipment of a router according to the present invention obtains the network traffic generated in the router via router networking, and analyzes whether the network traffic matches any preset preset rule; wherein, the The preset rule is the information matching rule for the pre-occurrence of the corresponding security event; if it matches, a corresponding prompt message is generated and sent to the corresponding authorized user to remind the authorized user of the security event currently being sent. The present invention uses preset rules corresponding to security events to compare current network traffic to identify security events connected to the wireless local area network and remind users in time, combining home security events that occur in the real world with traffic analysis in the network , so that the router has a certain security function, and enhances the security performance of the home network.

Description of drawings

FIG. 1 is a flow chart of the steps of a security monitoring method for a networked device of a router provided by an embodiment of the present invention;

FIG. 2 is an optional flow chart of the analysis and judgment steps of the security monitoring method for networked equipment of routers provided by an embodiment of the present invention;

FIG. 3 is a flow chart of optional rule configuration steps of a router networked device security monitoring method provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a networked device security monitoring system for routers provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an optional analysis and judgment unit of the networked device security monitoring system of a router provided by an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of the optional rule configuration unit of the router networked device security monitoring system provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

It should be noted that references in this specification to "one embodiment", "embodiment", "example embodiment" and the like mean that the described embodiment may include specific features, structures or characteristics, but not every Embodiments must include those specific features, structures or characteristics. Furthermore, such expressions are not referring to the same embodiment. Further, when specific features, structures or characteristics are described in conjunction with an embodiment, whether or not there is an explicit description, it has been indicated that it is within the knowledge of those skilled in the art to combine such features, structures or characteristics into other embodiments .

In addition, some terms are used in the description and the following claims to refer to specific components or components, and those skilled in the art should understand that manufacturers may use different nouns or terms to refer to the same component or component. This description and the subsequent claims do not use the difference in names as a way to distinguish components or parts, but use the differences in functions of components or parts as a criterion for distinguishing. "Includes" and "comprises" mentioned throughout the specification and the following claims are open-ended terms, so they should be interpreted as "including but not limited to". In addition, the term "connection" here includes any direct and indirect electrical connection means. Indirect means of electrical connection include connection through other means.

Fig. 1 shows a router's networked device security monitoring method provided by an embodiment of the present invention, including:

Step S101: Obtain network traffic generated via router networking. That is, this embodiment obtains the network traffic generated by networking through the wireless local area network built by the router, wherein the network traffic is data transmitted through the wireless local area network; data or related network requests, etc.

Step S102: Analyzing and judging whether the network traffic matches any preset rule; wherein, the preset rule is an information matching rule corresponding to pre-occurrence of security events. That is, each preset rule corresponds to a security event, and the security event is a specific behavior of a smart home appliance and the specific behavior is predefined as a behavior that poses a security threat; this embodiment is pre-configured with a preset corresponding to at least one smart home appliance. A rule is set, and when the network traffic generated through router networking is obtained, the network traffic is matched with any of the preset rules, and the comparison and matching is used to analyze and judge whether it conforms to any security event.

During specific implementation, the router matches the network traffic with the information in the preset rule according to the specified logic, so as to determine whether the network traffic conforms to the preset rule.

Step S103: If it matches the preset rule, generate a prompt message that the network traffic originates from the corresponding security event. When the network traffic matches any preset rule, it can be determined that the network source is generated from a security event corresponding to the preset rule, for example, a smart device is preset to perform a specific action or function within a specific time, The specific behavior of the smart device is preset as the security event, so that the specific security behavior of the smart device can be monitored through the router. The prompt message is used to prompt the occurrence of a corresponding security event. For example, if a smart device is started or shut down within a certain period of time, a prompt message related to the security event will be generated.

Step S104: Send the prompt message to the corresponding authorized user. The authorized user is at least one designated user preset; during specific implementation, the prompt message is sent to the mobile terminal of the authorized user in the form of a software application push message, a short message, a public account message, etc., such as a parent's mobile phone , tablet or personal computer, etc.

During the specific implementation, the router will analyze the network traffic in the home, and judge whether there is a specific event in the home through the analysis of the network layer. Homeowners can be set to be reminded if specific events occur.

In comparison, the matching of preset rules on network traffic on traditional routers is to monitor Trojan horses, viruses, privacy leaks, etc. at the network level, and is limited to the network world. Execute programs, APPs, etc. However, this embodiment analyzes network traffic through preset rules, innovatively maps network traffic to specific security events in the real world, and the main body of the detected security events is one or several specific IOT (Internet of Things) device, which can improve the router's security monitoring capabilities for smart devices in the home network.

Referring to Figure 2, step S102 specifically includes:

Step S1021: Analyze and obtain the networked device corresponding to the network traffic, traffic generation time, and traffic characteristics. After analyzing the network traffic, the networked device that generates the network traffic, the time when the traffic is generated, and the traffic characteristics of the network traffic are acquired. The networked device specifically refers to a smart device connected to the wireless local area network of a router, such as smart door locks, smart curtains, smart lights and other devices; the traffic generation time is specifically the time node or time period when the network traffic is generated; the traffic characteristics It includes various characteristics associated with the network traffic, such as related data forms, data requests, and data flow directions.

Step S1022: Determine whether the networked device, the traffic generation time, and the traffic characteristics all match the preset rule. That is, the preset rules include reference information respectively corresponding to networked devices, traffic generation time, and traffic characteristics; the preset rules can include multiple information dimensions, and the preset rules in this embodiment include specified devices, network Time of traffic occurrence, characteristics of network traffic, etc.

For example, a typical rule contains the following information:

Equipment: smart door lock;

Network traffic occurrence time: 0:00-7:00;

Network traffic characteristics: There is an upload request, and the request characteristic is: "unlocked successfully";

Then the security event corresponding to this rule is "between 0:00 and 7:00, someone successfully opened the smart door lock".

If the currently monitored network traffic matches the above preset rules, it can be determined that someone has successfully opened the smart door lock between 0:00 and 7:00. The event of opening the smart door lock within this time period is prefabricated as a security event that needs to be warned, so that a relevant prompt message is generated to the authorized user to prompt the security event that is currently occurring.

In one embodiment, step S1021 specifically includes: extracting the mac address corresponding to the network traffic, and identifying the corresponding networked device according to the mac address; analyzing and obtaining the network request corresponding to the network traffic The traffic generation time and the traffic characteristics of the network traffic. As in the above example, the network traffic recorded when the smart door lock is opened includes the relevant door lock start request, and the different behavioral characteristics of the smart device can generate specific network traffic, that is, in this embodiment, specific Behavioral network requests to analyze to determine their traffic characteristics.

Optionally, step S104 specifically includes: the server receives the prompt message uploaded by the router, and forwards the prompt message to a mobile terminal of an authorized user corresponding to the router. During specific implementation, the prompt message is generated in the router, and uploaded to the server connected to the router, and then the server forwards the prompt message to the mobile terminal of the authorized user; that is, the present embodiment does not require the authorized user to communicate with the The router connection only requires that the authorized user and the router be connected to the same server, and the server binds the corresponding authorized user and the router together, and determines the receiving end of the prompt message according to the binding relationship. The server then pushes the prompt message to the authorized user through multiple channels, and the information pushed to the authorized user at least includes: what event happened, when it happened, and the specific device where it happened.

In one embodiment, before step S102, the method further includes: downloading at least one preset rule into the router in response to the security monitoring function activated by the router. During specific implementation, the "housekeeping mode" corresponding to the security monitoring function is set on the control program of the router; the user can start the "housekeeping mode" on the APP (application program) corresponding to the router, thereby entering the security monitoring function; After the router starts this function, at least one of the preset rules is downloaded to the router, and some preset rules can also be pre-stored in the router; in this embodiment, the preset rules are preferably obtained from the server and sent to the router . For example, the user sets the housekeeping mode on the APP; after setting, the router will download a set of preset rules from the server; each preset rule corresponds to a security event, and the preset rules include corresponding network traffic for matching multiple dimensions of information.

In one embodiment, after step S102, the method further includes: configuring the preset rule corresponding to the security event according to the pre-occurring behavior characteristics of the security event.

Referring to FIG. 3, optionally, the step of configuring the preset rule corresponding to the security event according to the pre-occurring behavior characteristics of the security event specifically includes:

S111: Prefabricate the pre-occurring network behavior of the security event, and analyze the behavior characteristics of the network behavior.

S112: Configure the preset rule corresponding to the security event according to the behavior feature.

That is, the behavioral characteristics of the behavior corresponding to the preset security event are used as the basis for configuring the preset rules; the behavioral characteristics correspond to a series of associated behaviors and attributes generated when the security event occurs For example, the behavior characteristics of the security event corresponding to the configuration of a preset rule include: the name of the smart device, the sending time of the network traffic, and the characteristics of the network traffic.

For example, by analyzing the network traffic after a certain brand of smart door lock is successfully unlocked, the key features triggered by the unlocking behavior are extracted and configured into the preset rules. Then, if there is traffic passing through the router, and the router matches the corresponding key features in the preset rules, it can be considered that the behavior of "successfully unlocking a certain brand of smart door lock" has occurred.

The security event may be a simple event, or a complex event including multiple simple events and satisfy the condition of continuous occurrence. For example, simple events: after setting the housekeeping mode, the smart doorbell has frequent message reminders; complex events consist of multiple simple events, in a certain order of occurrence: after setting the housekeeping mode, the smart door lock is successfully unlocked, and after a period of time, the smart camera is blocked. closure. The network behavior of the prefabricated security event in this embodiment corresponds to a simple behavior or a complex behavior composed of multiple simple behaviors, and a series of continuous behavioral characteristics are used to configure the preset rules corresponding to the security event, that is, the prefabricated The configuration rules contain all the behavior characteristics of the corresponding security events, such as the name of the smart device, the time when the network traffic is generated, and the traffic characteristics.

Optionally, after step S104, the method further includes: intercepting the network traffic according to the interception instruction triggered by the authorized user. After the authorized user receives the prompt message, if the current network traffic is continuing, the network traffic can be intercepted by remotely triggering an interception command on a specific software program.

Figure 4 shows a security monitoring system 100 for networked equipment of a router provided by an embodiment of the present invention. This system 100 is applied to a router or a device connected to the router, and includes an acquisition unit 10, an analysis and judgment unit 20, a generation unit 30 and a sending unit. Unit 40, where:

The acquisition unit 10 is used to acquire network traffic generated via router networking; the analysis and judgment unit 20 is used to analyze and judge whether the network traffic matches any preset rule; wherein, the preset rule is a corresponding security event Pre-occurring information matching rules; the generating unit 30 is used to generate a prompt message that the network traffic originates from the corresponding security event if the generating unit 30 matches the preset rule; the sending unit 40 is used to send the prompt message to the corresponding authorized user.

This embodiment analyzes network traffic through preset rules, innovatively maps network traffic to specific security events in the real world, and the main body of the detected security events is one or several specific IOT (Internet of Things) devices , which can improve the security monitoring capability of the router to the smart devices in the home network.

Referring to FIG. 5 , in one embodiment, the analysis and judgment unit 20 specifically includes an analysis subunit 201 and a judgment subunit 202, wherein:

The analysis subunit 201 is used to analyze and obtain the networked device, traffic generation time and traffic characteristics corresponding to the network traffic; the judging subunit 202 is used to judge whether the networked device, the traffic generation time and the traffic characteristics all match the the preset rules.

Optionally, the analysis subunit 201 is specifically configured to: extract the mac address corresponding to the network traffic, and identify the corresponding networked device according to the mac address; analyze and obtain the network request according to the network traffic The traffic generation time and the traffic characteristic of the network traffic.

In one implementation manner, the sending unit 40 is specifically configured to: the server receives the prompt message uploaded by the router, and forwards the prompt message to a mobile terminal of an authorized user corresponding to the router. During specific implementation, the prompt message is generated in the router, and uploaded to the server connected to the router, and then the server forwards the prompt message to the mobile terminal of the authorized user; that is, the present embodiment does not require the authorized user to communicate with the The router connection only requires that the authorized user and the router be connected to the same server, and the server binds the corresponding authorized user and the router together, and determines the receiving end of the prompt message according to the binding relationship. The server then pushes the prompt message to the authorized user through multiple channels, and the information pushed to the authorized user at least includes: what event happened, when it happened, and the specific device where it happened.

Optionally, a rule downloading unit is also included, configured to download at least one of the preset rules into the router in response to the security monitoring function activated by the router. During specific implementation, the "housekeeping mode" corresponding to the security monitoring function is set on the control program of the router; the user can start the "housekeeping mode" on the APP (application program) corresponding to the router, thereby entering the security monitoring function; After the router starts this function, at least one of the preset rules is downloaded to the router, and some preset rules can also be pre-stored in the router; in this embodiment, the preset rules are preferably obtained from the server and sent to the router . For example, the user sets the housekeeping mode on the APP; after setting, the router will download a set of preset rules from the server; each preset rule corresponds to a security event, and the preset rules include corresponding network traffic for matching multiple dimensions of information.

Referring to FIG. 6 , an embodiment further includes a rule configuration unit 50 configured to configure the preset rule corresponding to the security event according to the pre-occurring behavior characteristics of the security event.

The rule configuration unit 50 specifically includes a parsing subunit 501 and a configuration subunit 502, wherein:

The parsing subunit 501 is used to prefabricate the pre-occurring network behavior of the security event, and analyze the network traffic characteristics of the network behavior; the configuration subunit 502 is used to configure all the corresponding security events according to the network traffic characteristics the preset rules.

Optionally, an interception unit is also included, configured to intercept the network traffic according to the interception instruction triggered by the authorized user.

The present invention also provides a storage medium for storing the computer program of the method for monitoring the security of networked equipment of the router as described in FIGS. 1 to 3 . For example, computer program instructions, when executed by a computer, can invoke or provide the method and/or technical solution according to the present application through the operation of the computer. The program instructions for invoking the method of the present application may be stored in fixed or removable storage media, and/or transmitted through broadcast or other data streams in signal-bearing media and/or stored in In the storage medium of the running computer equipment. Here, according to one embodiment of the present application, a computer device of a networked device security monitoring system including a router as shown in FIG. 4 , the computer device preferably includes a storage medium for storing computer programs and a processor for executing computer programs , wherein, when the computer program is executed by the processor, the computer device is triggered to execute the methods and/or technical solutions based on the aforementioned multiple embodiments.

It should be noted that the present application can be implemented in software and/or a combination of software and hardware, for example, it can be implemented by using an application specific integrated circuit (ASIC), a general-purpose computer or any other similar hardware devices. In one embodiment, the software program of the present application can be executed by a processor to realize the above steps or functions. Likewise, the software program (including associated data structures) of the present application can be stored in a computer-readable recording medium such as RAM memory, magnetic or optical drive or floppy disk and the like. In addition, some steps or functions of the present application may be implemented by hardware, for example, as a circuit that cooperates with a processor to execute each step or function.

The method according to the present invention can be implemented as a computer-implemented method on a computer, or in dedicated hardware, or in a combination of both. Executable code or parts thereof for a method according to the invention may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, and the like. Preferably, a computer program product comprises non-transitory program code means stored on a computer readable medium for carrying out the method according to the invention when said program product is executed on a computer.

In a preferred embodiment, the computer program comprises computer program code means adapted to perform all the steps of the method according to the invention when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

To sum up, the security monitoring method and system for router networked equipment described in the present invention obtains network traffic generated in routers via router networking, and analyzes whether the network traffic matches any preset preset rule. ; Wherein, the preset rule is an information matching rule corresponding to the pre-occurrence of a security event; if it matches, a corresponding prompt message is generated, and the prompt message is sent to the corresponding authorized user to remind the authorized user that the currently sending security incidents. The invention uses preset rules corresponding to security events to compare current network traffic to identify security events connected through the wireless local area network and remind users in time, thereby enhancing the security performance of the home network.

Certainly, the present invention also can have other multiple embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding Changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Also provided is A1, a networked device security monitoring method for a router, including steps:

Obtain network traffic generated via router networking;

Analyzing and judging whether the network traffic matches any preset preset rule; wherein, the preset rule is an information matching rule corresponding to a pre-occurrence of a security event;

If it matches the preset rule, generate a prompt message that the network traffic originates from the corresponding security event;

The prompt message is sent to the corresponding authorized user.

A2. According to the networked device security monitoring method for routers described in A1, the step of analyzing and judging whether the network traffic matches any preset rule specifically includes:

Analyzing and obtaining the networked device corresponding to the network traffic, traffic generation time, and traffic characteristics;

Judging whether the networked device, the traffic generation time, and the traffic characteristics all match the preset rule.

A3. According to the networked device security monitoring method of a router described in A2, the step of analyzing and obtaining the networked device corresponding to the network traffic, the time of traffic generation, and the traffic characteristics specifically includes:

Extracting the mac address corresponding to the network traffic, and identifying the corresponding networked device according to the mac address;

According to the network request corresponding to the network traffic, the traffic generation time and the traffic characteristics of the network traffic are analyzed and acquired.

A4. According to the method for monitoring networked device security of routers described in A1, the step of sending the prompt message to the corresponding authorized user specifically includes:

The server receives the prompt message uploaded by the router, and forwards the prompt message to the mobile terminal of the authorized user corresponding to the router.

A5. According to the networked device security monitoring method for routers described in A1, the step of analyzing and judging whether the network traffic matches any preset rule also includes:

In response to the security monitoring function activated by the router, at least one of the preset rules is downloaded to the router.

A6. According to the networked device security monitoring method for routers described in A1, the step of analyzing and judging whether the network traffic matches any preset rule also includes:

The preset rule corresponding to the security event is configured according to the pre-occurring behavior characteristics of the security event.

A7. According to the networked device security monitoring method for routers described in A6, the step of configuring the preset rules corresponding to the security events according to the pre-occurring behavior characteristics of the security events specifically includes:

Prefabricating the network behavior that occurs in advance of the security event, and analyzing the behavioral characteristics of the network behavior;

The preset rules corresponding to the security events are configured according to the behavior characteristics.

A8. According to the networked device security monitoring method for routers described in any one of A1-A7, after the step of sending the prompt message to the corresponding authorized user, it further includes:

The network traffic is intercepted according to the interception instruction triggered by the authorized user.

Also provided is B9, a networked device security monitoring system for routers, including:

an acquisition unit, configured to acquire network traffic generated via router networking;

An analysis and judgment unit, configured to analyze and judge whether the network traffic matches any preset preset rule; wherein, the preset rule is an information matching rule corresponding to a pre-occurrence of a security event;

a generating unit, configured to generate a prompt message that the network traffic originates from the corresponding security event if it matches the preset rule;

A sending unit, configured to send the prompt message to a corresponding authorized user.

B10, according to the networked device security monitoring system of the router described in B9, the analysis and judgment unit specifically includes:

An analysis subunit, configured to analyze and obtain the networked device corresponding to the network traffic, traffic generation time, and traffic characteristics;

A judging subunit, configured to judge whether the networked device, the traffic generation time, and the traffic characteristics all match the preset rule.

B11. According to the networked device security monitoring system for routers described in B10, the analysis subunit is specifically used for:

Extracting the mac address corresponding to the network traffic, and identifying the corresponding networked device according to the mac address;

According to the network request corresponding to the network traffic, the traffic generation time and the traffic characteristics of the network traffic are analyzed and acquired.

B12. According to the networked equipment security monitoring system of the router described in B9, the sending unit is specifically used for:

The server receives the prompt message uploaded by the router, and forwards the prompt message to the mobile terminal of the authorized user corresponding to the router.

B13. The networked device security monitoring system for routers according to B9, further comprising:

The rule downloading unit is configured to download at least one of the preset rules into the router in response to the security monitoring function activated by the router.

B14. The networked device security monitoring system for routers according to B9, further comprising:

A rule configuration unit configured to configure the preset rule corresponding to the security event according to the pre-occurring behavior characteristics of the security event.

B15. According to the networked device security monitoring system for routers described in B14, the rule configuration unit specifically includes:

An analysis sub-unit is used to prefabricate the network behavior that occurs in advance of the security event, and analyze the behavior characteristics of the network behavior;

The configuration subunit is configured to configure the preset rule corresponding to the security event according to the behavior feature.

B16. The networked device security monitoring system for routers according to any one of B9-B15, further comprising:

An intercepting unit, configured to intercept the network traffic according to the interception instruction triggered by the authorized user.

Also provided is C17, a storage medium for storing a computer program for executing any one of the methods for monitoring networked device security of routers described in A1-A8.

Also provided is D18, a computer, including a storage medium, a processor, and a computer program stored on the storage medium and operable on the processor, when the processor executes the computer program, A1 to A8 are realized The security monitoring method for networked equipment of routers described in any one of the above.

Claims (18)

1. A security monitoring method for networking equipment of a router is characterized by comprising the following steps:

acquiring network traffic generated through router networking;

analyzing and judging whether the network flow is matched with any preset rule or not; the preset rules are information matching rules of corresponding security events which are preset;

if the network traffic is matched with the preset rule, generating a prompt message that the network traffic comes from the corresponding security event;

and sending the prompt message to a corresponding authorized user.

2. The method for monitoring the security of the networking equipment of the router according to claim 1, wherein the step of analyzing and judging whether the network traffic matches any preset rule specifically comprises:

analyzing and obtaining networking equipment, flow generation time and flow characteristics corresponding to the network flow;

and judging whether the networking equipment, the flow generation time and the flow characteristics are all matched with the preset rule or not.

3. The method for monitoring the security of the networking equipment of the router according to claim 2, wherein the step of analyzing and obtaining the networking equipment, the traffic generation time and the traffic characteristics corresponding to the network traffic specifically comprises:

extracting a mac address corresponding to the network traffic, and identifying the corresponding networking equipment according to the mac address;

and analyzing and acquiring the flow generation time and the flow characteristics of the network flow according to the network request corresponding to the network flow.

4. The method for monitoring the security of the networking equipment of the router according to claim 1, wherein the step of sending the prompt message to the corresponding authorized user specifically comprises:

and the server receives the prompt message uploaded by the router and forwards the prompt message to a mobile terminal of an authorized user corresponding to the router.

5. The method for monitoring the security of the networking device of the router according to claim 1, wherein the step of analyzing and determining whether the network traffic matches any preset rule further comprises:

and responding to a security monitoring function started by the router, and downloading at least one preset rule into the router.

6. The method for monitoring the security of the networking equipment of the router according to claim 1, wherein the step of analyzing and determining whether the network traffic matches any preset rule further comprises:

and configuring the preset rule corresponding to the security event according to the behavior characteristics of the pre-occurrence of the security event.

7. The method for monitoring the security of the networking device of the router according to claim 6, wherein the step of configuring the preset rule corresponding to the security event according to the behavior feature of the pre-occurrence of the security event specifically comprises:

prefabricating a network behavior of the security event, which is expected to occur, and analyzing behavior characteristics of the network behavior;

and configuring the preset rules of the corresponding security events according to the behavior characteristics.

8. The method for monitoring the security of the networking equipment of the router according to any one of claims 1 to 7, wherein the step of sending the prompting message to the corresponding authorized user further comprises:

and intercepting the network flow according to an interception instruction triggered by the authorized user.

9. The utility model provides a networking device security protection monitoring system of router which characterized in that includes:

an acquisition unit configured to acquire network traffic generated by networking via a router;

the analysis and judgment unit is used for analyzing and judging whether the network flow is matched with any preset rule or not; the preset rules are information matching rules of corresponding security events which are preset;

the generating unit is used for generating a prompt message that the network flow comes from the corresponding security event if the network flow is matched with the preset rule;

and the sending unit is used for sending the prompt message to a corresponding authorized user.

10. The system of claim 9, wherein the analyzing and determining unit comprises:

the analysis subunit is used for analyzing and obtaining networking equipment, traffic generation time and traffic characteristics corresponding to the network traffic;

and the judging subunit is used for judging whether the networking equipment, the flow generation time and the flow characteristics are all matched with the preset rule.

11. The networked device security monitoring system of a router of claim 10, wherein the analysis subunit is specifically configured to:

extracting a mac address corresponding to the network traffic, and identifying the corresponding networking equipment according to the mac address;

and analyzing and acquiring the flow generation time and the flow characteristics of the network flow according to the network request corresponding to the network flow.

12. The system of claim 9, wherein the sending unit is specifically configured to:

and the server receives the prompt message uploaded by the router and forwards the prompt message to a mobile terminal of an authorized user corresponding to the router.

13. The router's networked device security monitoring system of claim 9, further comprising:

and the rule downloading unit is used for responding to a security monitoring function started by the router and downloading at least one preset rule to the router.

14. The router networking device security monitoring system of claim 9, further comprising:

and the rule configuration unit is used for configuring the preset rule corresponding to the security event according to the behavior characteristics of the pre-occurrence of the security event.

15. The system according to claim 14, wherein the rule configuration unit specifically comprises:

the analysis subunit is used for prefabricating the network behavior of the security event, and analyzing the behavior characteristics of the network behavior;

and the configuration subunit is used for configuring the preset rules of the corresponding security events according to the behavior characteristics.

16. The system for monitoring the security of the networked devices of the router according to any one of claims 9 to 15, further comprising:

and the interception unit is used for intercepting the network flow according to an interception instruction triggered by the authorized user.

17. A storage medium storing a computer program for executing the method for monitoring security of networked devices of a router according to any one of claims 1 to 8.

18. A computer comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the method for monitoring the security of the networked devices of the router according to any one of claims 1 to 8 when executing the computer program.

Images