Network detection system based on big data analysis

Abstract

The invention provides a network detection system based on big data analysis, which comprises a network interface, a network management module, a detection module, a security module, an analysis module, a processing module, an early warning module and a processor, and is characterized in that the detection module detects the states of the network interface and the network management module to obtain state data of a network communication channel; the security and protection module is used for filtering transmission data of the network interface so as to actively protect network communication data; the analysis module analyzes the data based on the data received by the user access end; the processing module is used for processing network abnormity and prompting abnormal data to the user access end; and the early warning module is used for carrying out early warning on the on-off state of the network transmission channel so as to realize interactive feedback prompt on the network state. According to the invention, data of each network interface is filtered through the analysis unit, so that active protection of risks is realized.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a network detection system based on big data analysis. Background technique [0002] As a key facility for protecting the connected network property, the enterprise firewall, all messages transmitted from the external network to the internal server will first be sent to the firewall gateway, and then forwarded to different internal business servers through the firewall gateway, so the firewall gateway will often receive To an uncountable mass of message data, which contains attack data disguised from various attackers. Due to the extremely high speed of network traffic, both storage of data and real-time analysis will cause unacceptable space / time consumption, resulting in a higher cost of attack protection than the enterprise accepts. [0003] For example, the prior art of CN112422513B discloses an anomaly detection and attack initiator analysis system based on ne...

AI Technical Summary

Problems solved by technology

[0005] (Remote Authentication Dial In User Service, remote user dial-in authentication system), portal (entry) authentication request process are all initiated by BRAS (Broadband Remote Access Server, broadband access server), and exchange with radius and portal server; Therefore, no authentication data has passed through the analysis equipment, and the authentication data initiated by BRAS cannot be associated with specific analysis equipment one by one.

In this environment, some network analysis schemes do not associate IP (Internet Protocol, Internet Protocol) with users, but directly analyze according to IP; The real user name cannot match the IP with the real user, so it is difficult to conduct effective analysis and accurately locate the real user

Some solutions are to directly query or synchronize the online user data of the radius server, and then associate the IP with the real user; this kind of solution has poor real-time performance and additionally increases the pressure on the server

Some solutions directly mirror all the authentication data to the analysis device, and then perform analysis and correlation on the local machine; this solution requires additional additional mirroring devices, which increases costs, and the analysis of multiple analysis devices is the same. The aggregated authentication data causes performance loss of the analysis equipment

[0006] In order to solve the common problems in the field of poor network detection performance, inability to identify real addresses, simple passive defense, inability to implement active protection, and poor real-time performance, the present invention is made

Images