CN202424749U - Intranet flow control system - Google Patents

Abstract

The utility model discloses an intranet flow control system, which comprises a central node database, a collector, a central node analyzer and a monitoring terminal. The collector is arranged at a network node and connected to the central node. The central node analyzer Also connected with the central node, the collector collects the process flow information of the node, and reports the collected node process flow information to the central node analyzer connected to the central node, and the central node analyzer reports the process flow information of the node The flow information is analyzed in real time, the analysis results are output, and written into the central node database connected to the central node, and the monitoring terminal is connected to the central node analyzer; the configuration command of the monitoring terminal to the collector is forwarded through the central node analyzer. In the monitoring of the intranet flow through the intranet flow control system of the utility model, it has the advantages of high recognition performance and low recognition false alarm rate and false negative rate.

Description

Intranet flow control system

technical field

The utility model relates to the field of flow monitoring in the electric power industry, in particular to an intranet flow control system.

Background technique

With the popularity of the Internet, the occurrence of network security incidents is getting closer and closer to us, and we may encounter the following situations: 

1) Employees use working hours to chat, trade stocks, play online games and other behaviors, which affect work efficiency;

2) Employees visit bad websites and suffer malicious code, spyware and phishing attacks, etc., affecting the normal operation of the corporate network;

3) Employees randomly use P2P downloads, online videos, etc., seriously occupying network bandwidth, resulting in the inability to obtain sufficient network resources for normal business;

4) Employees browse illegal websites, publish sensitive information and spread illegal speeches, causing adverse social impact and may lead to national legal issues;

5) Employees randomly send sensitive business information through EMAIL, instant messaging, etc., resulting in information leakage incidents;

6) Compliance management requirements. According to the "Regulations on Technical Measures for Internet Security Protection", Internet service providers and enterprises and institutions connected to the Internet must record and track network operation status, monitor Internet security incidents, and manage illegal information on the network. the

In intranet traffic monitoring, in order to achieve effective monitoring, we must first achieve effective traffic analysis, which involves specific traffic detection. In the current intranet traffic monitoring system, the detection of P2P flow has always been a difficult point , is also a hot spot today.

P2P traffic has the following basic characteristics:

(1) The average connection time of P2P applications is relatively long, which is different from the short connection time of traditional applications.

(2) Due to load balancing, P2P hosts usually only establish fewer port connections, which is different from the characteristics of more traditional host communication connections.

(3) The P2P host is both a server and a client, which is different from the traditional host that only assumes one role.

(4) Due to the characteristics of the P2P protocol itself, it will connect and exchange information with many users, which is different from the characteristics that traditional users only connect with a few users or servers.

(5) The flow of P2P hosts is more reflected in the basic symmetry of upstream and downstream traffic, which is different from the characteristic that the downstream traffic of traditional hosts is greater than the upstream traffic.

Currently Commonly Used P2P Flow Detection Methods

(1) Port matching: P2P identification is carried out through the protocol type and port number of the data packet. The disadvantages are: there are new protocols and ports added to the P2P application port table, the port table is not easy to maintain; in addition, the dynamic ports are not easy to maintain; at the same time, it is powerless for some VPN applications or applications converted by NAT.

(2) Deep packet inspection: Match the characteristic bit string of the P2P data packet. For example, for BT, if the data area of the IP packet contains the characteristic string "BitTorrent protocol" of the BT protocol, then the data packet is prohibited from passing. In this way, the handshake of the BT peer-to-peer connection cannot be established, and the download cannot continue. This detection method is easy to understand, easy to upgrade, easy to maintain, and has a very high hit rate. In principle, it can basically detect all P2P traffic, so it is currently the most common and mature method. However, this method also has the following disadvantages: the detection efficiency is low, the identification rules need to be defined in advance, and the payload content of a certain length in the data packet needs to be analyzed, which not only has the hidden danger of violating user privacy, but also brings more storage space high demands.

(3) Identification based on flow characteristics: As a new type of application that makes full use of client resources, the flow characteristics of P2P applications at the network layer and transport layer are different from other applications, such as HTTP, FTP, DNS, etc. The place. The detection technology based on traffic characteristics is to discover P2P applications by detecting these new traffic characteristics.

Contents of the invention

The utility model overcomes the deficiencies of the prior art, and provides an intranet flow control system with high recognition performance and low recognition false alarm rate and false negative rate.

In order to solve the above-mentioned technical problems, the utility model adopts the following technical solutions:

An intranet flow control system, comprising a central node database, a collector, a central node analyzer and a monitoring terminal, the collector is arranged at a network node and connected to the central node, and the central node analyzer is also connected to the central node , the collector collects the process flow information of the node, and reports the collected node process flow information to the central node analyzer connected to the central node, and the central node analyzer performs real-time analysis on the process flow information of the reported node , output the analysis result, and write it into the central node database connected with the central node, and the monitoring terminal is connected with the central node analyzer.

In order to better realize the utility model, further technical improvements are made below:

As a preference: the configuration command of the monitoring terminal to the collector is forwarded through the central node analyzer.

Preferably, the above-mentioned collector adjusts the size of the sliding window of the collector and the collected index content according to the configuration command.

As a preference: the monitoring terminal graphically displays the analysis results of the central node analyzer, and provides graphical information to the network management server connected thereto, and the monitoring terminal is provided with an interface connected to the network management server.

As a preference: the above-mentioned collector and central node analyzer provide expandable function modules.

Preferably: the above-mentioned expandable function module is one of intranet monitoring, network analysis, botnet identification, terminal management, keylogging, and voice monitoring.

The utility model can also be the following technical solutions:

There are three collectors mentioned above.

Compared with the prior art, the beneficial effects of the utility model are:

In the monitoring of the intranet flow through the intranet flow control system of the utility model, it has the characteristics of high identification performance and low identification false alarm rate and false negative rate.

Description of drawings

Fig. 1 is the schematic diagram of the principle of the utility model;

Wherein, the names corresponding to the reference signs in the accompanying drawings are:

1-central node database, 2-collector, 3-central node, 4-central node analyzer, 5-monitoring terminal.

Detailed ways

The utility model will be further described in detail below in conjunction with the examples, but the implementation of the utility model is not limited thereto.

As shown in Figure 1, a kind of intranet flow control system comprises a central node database 1, a collector 2, a central node analyzer 4 and a monitoring terminal 5, and the collector 2 is arranged at a network node and connected to a central node 3 , the central node analyzer 4 is also connected to the central node 3, the collector 2 collects the process flow information of the node, and reports the collected node process flow information to the central node analyzer 4 connected to the central node 3 , the central node analyzer 4 analyzes the process flow information of the reporting node in real time, outputs the analysis result, and writes it into the central node database 1 connected to the central node 3, and the monitoring terminal 5 is connected to the central node analyzer 4.

The configuration command of the monitoring terminal 5 to the collector 2 is forwarded by the central node analyzer 4; the monitoring terminal 5 graphically displays the analysis results of the central node analyzer 4, and provides the graphical information to the external network management server connected thereto. The monitoring terminal 5 is provided with an interface connected to an external network management server.

The collector 2 adjusts the size of the sliding window of the collector 2 and the collected index content according to the configuration command.

The collector 2 and the central node analyzer 4 provide an expandable function module, and the expandable function module is one of intranet monitoring, network analysis, botnet identification, terminal management, keyboard recording, and voice monitoring.

There are three collectors 2 in this embodiment, and of course the number of collectors 2 depends on the actual situation.

The workflow of this embodiment is further described below:

1. The new collector 2 sends registration information to the central node analyzer 4;

2. The central node analyzer 4 returns the authentication account number and authentication password assigned by the collector 2;

3. Collector 2 sends authentication information to the central node analyzer;

4. The central node analyzer 4 verifies the authentication information, and when successful, prompts the monitoring terminal 5 that a new collector 2 is online, and returns authentication success information to the collector 2 at the same time;

5. Collector 2 collects process behavior information of nodes;

6. When the sliding window time is up, the collector 2 reports the process behavior information of the node to the central node analyzer 4;

7. The central node analyzer 4 analyzes the process behavior information of the node;

8. The monitoring terminal 5 displays according to the analysis results.

The intranet flow control system of the present invention has the following characteristics:

1) Supports real-time monitoring of network connections of internal network multi-node processes, and collects detailed information about network connections of all processes, including source IP and destination IP, source port and destination port, and network connection status of network connections;

2) Support real-time monitoring of network transmission of multi-node processes inside the network, use winpcap to capture packets, obtain the total traffic and upstream and downstream traffic in the sliding window, and then obtain the network transmission rate and upstream and downstream traffic ratio of each process respectively.

3) On the basis of capturing packets of multi-node processes inside the network, analyze the data packets. In this way, a node graph interacting with the node is constructed to calculate the node distribution degree of the node.

4) The central node 3 makes statistics on the network behavior of multi-node processes inside the network, and uses multi-feature judgment algorithm and multi-node behavior similarity algorithm to detect P2P nodes and P2P processes.

The intranet flow control system provides a good monitoring interface on the basis of collecting the network behavior of the system process.

The currently implemented Demo can achieve the following functions:

A. Real-time dynamic display of the average network connection number curve of all processes of the internal nodes of the network;

B. Real-time dynamic display of the network transmission rate curve of all processes of the internal nodes of the network;

C. Real-time dynamic display of the uplink and downlink traffic ratio curves of all processes of the internal nodes of the network;

D. Real-time dynamic display of the network connection node distribution curve of all processes of the internal nodes of the network;

E. Use the sliding window mode to report process network behavior information, and the central node is responsible for analyzing these behavior information, and identifying P2P nodes and P2P processes according to the multi-feature judgment algorithm and multi-node behavior similarity algorithm.

F. Provide an open interface, which can support a variety of network traffic analysis and identification functions with simple development.

In summary, the utility model can be better realized.

The above content is a further detailed description of the utility model in combination with specific preferred embodiments, and it cannot be assumed that the specific implementation of the utility model is only limited to these descriptions. For a person of ordinary skill in the technical field to which the utility model belongs, without departing from the concept of the utility model, some simple deduction or substitutions can also be made, which should be regarded as belonging to the protection scope of the utility model.

Claims (7)

1. Intranet flow control system; It is characterized in that: described control system comprises Centroid database (1), collector (2), Centroid analyzer (4) and monitoring client (5); Said collector (2) is arranged on the network node place and is connected with Centroid (3); Said Centroid analyzer (4) also is connected with Centroid (3), and said collector (2) is gathered the process flow information of node, and reports the node process flow information that collects to the Centroid analyzer (4) that is connected with Centroid (3); Said Centroid analyzer (4) carries out real-time analysis to the process flow information that reports node; The output analysis result, and write the Centroid database (1) that is connected with Centroid (3), said monitoring client (5) also is connected with Centroid analyzer (4).

2. Intranet flow control system according to claim 1 is characterized in that: said monitoring client (5) is transmitted through Centroid analyzer (4) the configuration order of collector (2).

3. Intranet flow control system according to claim 2 is characterized in that: said collector (2) is adjusted the sliding window size and the index content of gathering of collector (2) according to configuration order.

4. Intranet flow control system according to claim 1; It is characterized in that: said monitoring client (5) graphically shows the analysis result of Centroid analyzer (4); And graphical information offered connected NM server, said monitoring client (5) is provided with the interface that is connected with NM server.

5. Intranet flow control system according to claim 1 is characterized in that: said collector (2) and Centroid analyzer (4) provide the extendable functions module.

6. Intranet flow control system according to claim 5 is characterized in that: said extendable functions module is a kind of in Intranet monitoring, network analysis, Botnet identification, terminal management, keyboard record, the audio monitoring.

7. Intranet flow control system according to claim 1 is characterized in that: described collector (2) has three.