Method and apparatus for detecting data collection omission in traffic collection device

Abstract

The invention discloses a method for detecting data collection omission in a traffic collection device and relates to an information security technology in the technical field of information. The method comprises the following steps: step 1 is discovery of omission of active IP data, and step 2 is discovery of omission of active domain name data. According to the invention, a DNS data source is used to supplement original data, and data which has the attribute of a computer room is extracted, and then a simulation request is performed, such that the performance demand for the simulation request is reduced, a more comprehensive simulation request is also provided, and discovered omission is more comprehensive and accurate. When the simulation request is performed, an http (get / post) requestis firstly performed, and then afterwards, data whose simulation request result return values are not within a reasonable scope is subjected to an https (get / post) request. Such a mode, compared to amode of performing http&https simulation requests on all data, can reduce the performance demand for the simulation request, and compared to a mode of only performing the http simulation request, canalso enhance comprehensiveness of the simulation request. According to the invention, the network supervision level can be effectively improved, and data missed by an information security managementsystem is discovered for analysis of omission reasons of the information security management system.

Description

technical field [0001] The invention relates to the field of information security technology in the field of information technology, especially the field of Internet management and control. Background technique [0002] At present, the relevant Internet management departments and enterprises in the communication industry of various provinces and cities deploy active traffic collection equipment at all enterprise operators in the provinces and cities to obtain network traffic data, and access traffic data mainly through http / https requests. Some devices also include FTP, POP3, STMP and other access. Relevant Internet management departments and enterprises obtain and record the source IP, access domain name, IP address of the access domain name and other information in the access traffic data through collection equipment, and use it as a data source for analyzing the network development of the province. Generally, the active traffic data collection device deployed at the ente...

AI Technical Summary

Problems solved by technology

This paper shows that the method of data wandering collection is not unique, and the collection of data traffic can also be done through the SNMP protocol. Similarly, the present invention does not use the SNMP protocol in data collection

Images