[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

CN105893462A - User network behavior analysis method and device - Google Patents

User network behavior analysis method and device Download PDF

Info

Publication number
CN105893462A
CN105893462A CN201610172502.1A CN201610172502A CN105893462A CN 105893462 A CN105893462 A CN 105893462A CN 201610172502 A CN201610172502 A CN 201610172502A CN 105893462 A CN105893462 A CN 105893462A
Authority
CN
China
Prior art keywords
data package
search
search engine
network data
package informatin
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201610172502.1A
Other languages
Chinese (zh)
Inventor
柏昆
朱震
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Baishi Software (beijing) Co Ltd
Original Assignee
Baishi Software (beijing) Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Baishi Software (beijing) Co Ltd filed Critical Baishi Software (beijing) Co Ltd
Priority to CN201610172502.1A priority Critical patent/CN105893462A/en
Publication of CN105893462A publication Critical patent/CN105893462A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/95Retrieval from the web
    • G06F16/951Indexing; Web crawling techniques

Landscapes

  • Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a user network behavior analysis method and device, relates to the technical field of software development, and aims at solving the problem that the conventional network safety audition and analysis system cannot carry out targeted statistics on the user network behaviors. The method comprises the following steps: obtaining a network data package transmitted by an exchanger through a probe server; analyzing the network data package through a network data package analysis program to obtain network data package information; storing the network data package information in a search engine, wherein the search engine is used for classifying the network data package information and setting a search grammar according to the classification result; obtaining data package information matched with a search word through accessing to the search engine, wherein the search word accords with a search grammar stipulation.

Description

A kind of user network behavior analysis method and device
Technical field
The present invention relates to technical field of software development, more particularly relate to a kind of user network behavior analysis method And device.
Background technology
Computer network security audit (Audit) refers to according to certain security strategy, utilizes record, system to live The information such as dynamic and User Activity, check, examine and the environment of checked operation event and activity, thus find be System leak, intrusion behavior or improve the process of systematic function.
Existing network security audit and the system of analysis are typically by packet capturing post analysis packet on switches Mode, generates initial data, and these initial datas comprise MAC (Media Access Control, Chinese Be called for short: media interviews control) address, source IP (Internet Protocol, Chinese be called for short: net association), source Mouth, Target IP, target port, access URL (Uniform Resource Locator, Chinese be called for short: URL), download file etc..For these initial datas, process further and may determine that User accesses the network behaviors such as website, microblogging, forum, receiving and dispatching mail, transmission file, remote access.Root According to said method, further can pass through by the network behavior record of user in the data base of relationship type The data recorded in relevant database are shown by the Web page of design.But said method, also There is problems in that when data volume is bigger, obtain the network behavior of user and show in Web page Record data in relevant database are slower;Based on time, MAC Address or IP address party The network behavior of formula record user and show record data in relevant database in Web page not Enough directly perceived, it is impossible to well to embody the contact between data and dependency;User can not be retrieved at various networks The key word simultaneously occurred in behavior.
In sum, existing network security audit and analysis system exist to enter for user network behavior The problem of row specific aim statistics.
Summary of the invention
The embodiment of the present invention provides a kind of user network behavior analysis method and device, in order to solve existing net There is the problem that can not carry out specific aim statistics for user network behavior in network security audit and analysis system.
The embodiment of the present invention provides a kind of user network behavior analysis method, including:
By probe server, obtain the network packet transmitted by switch;
Analyze program by network packet described network packet is analyzed, obtain described network data Package informatin;
Described network data package informatin is preserved to search engine;Wherein, described search engine is to described network Packet information is classified, and arranges search grammer according to described classification results;
By accessing described search engine, obtain the described packet information mated with search word, wherein, institute State search word and meet described search phrase law regulation.
Preferably, described network data package informatin includes that one or more in following information combine:
MAC Address, source IP address, target ip address, source port, target port, host-host protocol.
Preferably, described described network data package informatin is preserved to search engine, including:
By the application programming interface of described search engine, described network data package informatin is preserved to institute State search engine.
The embodiment of the present invention also provides for a kind of user network behavior analysis device, including:
First acquiring unit, for by probe server, obtaining the network packet transmitted by switch;
Second acquisition unit, is carried out described network packet point for analyzing program by network packet Analysis, obtains described network data package informatin;
Storage unit, for preserving described network data package informatin to search engine;Wherein, described search Described network data package informatin is classified by engine, and arranges search grammer according to described classification results;
3rd acquiring unit, for by accessing described search engine, obtaining the described number mated with search word According to package informatin, wherein, described search word meets described search phrase law regulation.
Preferably, described network data package informatin includes that one or more in following information combine:
MAC Address, source IP address, target ip address, source port, target port, host-host protocol.
Preferably, described storage unit specifically for:
By the application programming interface of described search engine, described network data package informatin is preserved to institute State search engine.
In the embodiment of the present invention, by probe server, obtain the network packet transmitted by switch; Analyze program by network packet described network packet is analyzed, obtain described network packet letter Breath;Described network data package informatin is preserved to search engine;Wherein, described search engine is to described network Packet information is classified, and arranges search grammer according to described classification results;By accessing described search Engine, obtains the described packet information mated with search word, and wherein, described search word meets described search Grammatical norm.In said method, the network packet transmitted by switch is analyzed, after analyzing Described network packet preserve in search engine, can be by meeting the search phrase that search engine is provided The network packet preserved is retrieved by the search word of method, obtains the described packet letter mated with search word Breath, further, it is also possible to according to actual needs, in a search engine input personalized and meet search The search word of grammer, obtains user's data interested and the knot obtained according to described data interested Opinion.Can not be for user network behavior such that it is able to solve that existing network security audit and analysis system exist The problem carrying out specific aim statistics.
Accompanying drawing explanation
In order to be illustrated more clearly that the embodiment of the present invention or technical scheme of the prior art, below will be to enforcement In example or description of the prior art, the required accompanying drawing used is briefly described, it should be apparent that, describe below In accompanying drawing be only some embodiments of the present invention, for those of ordinary skill in the art, do not paying On the premise of going out creative work, it is also possible to obtain other accompanying drawing according to these accompanying drawings.
A kind of user network behavior analysis method schematic flow sheet that Fig. 1 provides for the embodiment of the present invention;
A kind of user network behavior analysis apparatus structure schematic diagram that Fig. 2 provides for the embodiment of the present invention.
Detailed description of the invention
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clearly Chu, be fully described by, it is clear that described embodiment be only a part of embodiment of the present invention rather than Whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art are not making creation The every other embodiment obtained under property work premise, broadly falls into the scope of protection of the invention.
What Fig. 1 was exemplary shows a kind of user network behavior analysis method flow process that the embodiment of the present invention provides Schematic diagram, the method may at least apply in network data statistics.
As it is shown in figure 1, a kind of user network behavior analysis method that the embodiment of the present invention provides, including following Step:
Step 101, by probe server, obtains the network packet transmitted by switch;
Step 102, analyzes program by network packet and is analyzed described network packet, obtain institute State network data package informatin;
Step 103, preserves described network data package informatin to search engine;Wherein, described search engine Described network data package informatin is classified, and search grammer is set according to described classification results;
Step 104, by accessing described search engine, obtains the described packet information mated with search word, Wherein, described search word meets described search phrase law regulation.
In a step 101, connected with the server of deployment in network by netting twine due to the mirror image network interface of switch Connect, i.e. can obtain by connecting the probe server installing network packet analysis program on switches The network packet transmitted by switch.
In a step 102, being provided with network packet and analyze program in probe server, this program can be led to Cross network data package, obtain network data package informatin.
Specifically, network data package informatin includes following a kind of information or the combination of much information: MAC Address, source IP address, target ip address, source port, target port, host-host protocol.Real in the present invention Executing in example, the content specifically including network data package informatin does not limits.
In step 103, the network data package informatin got is possibly stored in search engine, specifically Ground, network packet analyze application programming interface that program provided by search engine (English is: Application Programming Interface, English abbreviation API), network data package informatin is preserved extremely In search engine.
In embodiments of the present invention, in order to complete rapidly for user, MAC Address or IP ground The network behavior statistics of location, and by using search engine to obtain the retrieval result of above-mentioned data, it is preferable that The network packet preserved is classified by search engine according to information type, and according to classification results, if Put the search grammer corresponding with classification results.
Concrete, the network behavior statistics for user, MAC Address or IP address can include following Multiple method:
The key word that a: counting user occurs in various network behaviors simultaneously;
The number of times that b: the counting user identical network behavior in setting the time period occurs;
C: by association user, MAC Address and/or IP address, counting user is within the time period set The number of times that identical network behavior occurs;
D: by associate device title, MAC Address and/or IP address, statistics equipment is setting the time period The number of times that interior identical network behavior occurs;
E: add up ranking or the ranking of equipment of user in various network behaviors within the setting time period Situation.
In embodiments of the present invention, it is possible to use search engine include but not limited to: Elastic Search, Solr etc..
At step 104, by accessing described search engine, obtain the packet letter matched with search word Breath.
In embodiments of the present invention, due to according to preserve to the packet information of search engine determine with The search grammer that packet classification result is corresponding, therefore, the search word used in this step should comply with Search phrase law regulation.
Specifically, input search word in a search engine, those users, MAC Address or IP can be checked The network behavior of address occurs in that this search word;Input search word in a search engine, can check various In network behavior, those users, MAC Address or IP address occur in that this search word simultaneously;At search engine Middle input search word, can check this search word within a certain period of time, those users, MAC Address or Transmitted on that network behavior of IP address and spread;Further, it is also possible to definition search word, When network behavior occurs this search word, this network behavior is carried out record, and can pass through mail, note, The modes such as wechat carry out alarm prompt to this network behavior.
Further, by inputting search word in a search engine, can get relevant to this search word Information, in embodiments of the present invention, in order to complete at a high speed network behavior statistics, can pass through form, The information relevant to search word got is carried out visual presentation by the modes such as chart, and can be clearly Express the contact between data and dependency.
Concrete, in a search engine after input search word, detailed packet can be shown by form Record information;The row of the displays such as column, broken line graph, the pie chart network behavior relevant to search word can be passed through Name situation.In embodiments of the present invention, the mode of display with search word relevant information is not done concrete restriction.
Further, it is also possible to according to actual needs, perform more personalized retrieval in a search engine, Wherein, the search word corresponding to personalized retrieval should comply with search grammar request, such that it is able to get use The data that family is interested, and obtain related conclusions according to the data got.
Based on same inventive concept, embodiments provide kind of a user network behavior analysis device, due to It is similar to planting user network behavior analysis method that this device solves the principle of technical problem, the therefore reality of this device Execute the enforcement of the method for may refer to, repeat no more in place of repetition.
As in figure 2 it is shown, the kind user network behavior analysis device provided for the embodiment of the present invention, including: the One acquiring unit 201, second acquisition unit 202, storage unit 203 and the 3rd acquiring unit 204.
First acquiring unit 201, for by probe server, obtaining the network number transmitted by switch According to bag;
Second acquisition unit 202, is carried out described network packet for analyzing program by network packet Analyze, obtain described network data package informatin;
Storage unit 203, for preserving described network data package informatin to search engine;Wherein, described Described network data package informatin is classified by search engine, and arranges search phrase according to described classification results Method:
3rd acquiring unit 204, for by accessing described search engine, obtaining the institute mated with search word Stating packet information, wherein, described search word meets described search phrase law regulation.
Preferably, described network data package informatin includes that one or more in following information combine:
MAC Address, source IP address, target ip address, source port, target port, host-host protocol.
Preferably, described storage unit 203 specifically for:
By the application programming interface of described search engine, described network data package informatin is preserved to institute State search engine.
Should be appreciated that this equipment dress according to unit that one of the above user network behavior analysis device includes is only Put the logical partitioning that the function of realization is carried out, in actual application, superposition or the fractionation of said units can be carried out. And the function that realized of a kind of user network behavior analysis device that this embodiment provides and above-described embodiment There is provided a kind of user network behavior analysis method one_to_one corresponding, for this device realized more detailed Handling process, is described in detail in said method embodiment one, is not described in detail herein.
Those skilled in the art are it should be appreciated that embodiments of the invention can be provided as method, system or meter Calculation machine program product.Therefore, the present invention can use complete hardware embodiment, complete software implementation or knot The form of the embodiment in terms of conjunction software and hardware.And, the present invention can use and wherein wrap one or more Computer-usable storage medium containing computer usable program code (include but not limited to disk memory, CD-ROM, optical memory etc.) form of the upper computer program implemented.
The present invention is with reference to method, equipment (system) and computer program product according to embodiments of the present invention The flow chart of product and/or block diagram describe.It should be understood that can by computer program instructions flowchart and / or block diagram in each flow process and/or flow process in square frame and flow chart and/or block diagram and/ Or the combination of square frame.These computer program instructions can be provided to general purpose computer, special-purpose computer, embedding The processor of formula datatron or other programmable data processing device is to produce a machine so that by calculating The instruction that the processor of machine or other programmable data processing device performs produces for realizing at flow chart one The device of the function specified in individual flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.
These computer program instructions may be alternatively stored in and computer or the process of other programmable datas can be guided to set In the standby computer-readable memory worked in a specific way so that be stored in this computer-readable memory Instruction produce and include the manufacture of command device, this command device realizes in one flow process or multiple of flow chart The function specified in flow process and/or one square frame of block diagram or multiple square frame.
These computer program instructions also can be loaded in computer or other programmable data processing device, makes Sequence of operations step must be performed to produce computer implemented place on computer or other programmable devices Reason, thus the instruction performed on computer or other programmable devices provides for realizing flow chart one The step of the function specified in flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.
Although preferred embodiments of the present invention have been described, but those skilled in the art once know base This creativeness concept, then can make other change and amendment to these embodiments.So, appended right is wanted Ask and be intended to be construed to include preferred embodiment and fall into all changes and the amendment of the scope of the invention.
Obviously, those skilled in the art can carry out various change and modification without deviating from this to the present invention Bright spirit and scope.So, if the present invention these amendment and modification belong to the claims in the present invention and Within the scope of its equivalent technologies, then the present invention is also intended to comprise these change and modification.

Claims (6)

1. a user network behavior analysis method, it is characterised in that including:
By probe server, obtain the network packet transmitted by switch;
Analyze program by network packet described network packet is analyzed, obtain described network data Package informatin;
Described network data package informatin is preserved to search engine;Wherein, described search engine is to described network Packet information is classified, and arranges search grammer according to described classification results;
By accessing described search engine, obtain the described packet information mated with search word, wherein, institute State search word and meet described search phrase law regulation.
2. the method for claim 1, it is characterised in that described network data package informatin include with One or more combinations in lower information:
MAC Address, source IP address, target ip address, source port, target port, host-host protocol.
3. the method for claim 1, it is characterised in that described by described network data package informatin Preserve to search engine, including:
By the application programming interface of described search engine, described network data package informatin is preserved to institute State search engine.
4. a user network behavior analysis device, it is characterised in that including:
First acquiring unit, for by probe server, obtaining the network packet transmitted by switch;
Second acquisition unit, is carried out described network packet point for analyzing program by network packet Analysis, obtains described network data package informatin;
Storage unit, for preserving described network data package informatin to search engine;Wherein, described search Described network data package informatin is classified by engine, and arranges search grammer according to described classification results;
3rd acquiring unit, for by accessing described search engine, obtaining the described number mated with search word According to package informatin, wherein, described search word meets described search phrase law regulation.
5. device as claimed in claim 4, it is characterised in that described network data package informatin include with One or more combinations in lower information:
MAC Address, source IP address, target ip address, source port, target port, host-host protocol.
6. device as claimed in claim 4, it is characterised in that described storage unit specifically for:
By the application programming interface of described search engine, described network data package informatin is preserved to institute State search engine.
CN201610172502.1A 2016-03-20 2016-03-20 User network behavior analysis method and device Pending CN105893462A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610172502.1A CN105893462A (en) 2016-03-20 2016-03-20 User network behavior analysis method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610172502.1A CN105893462A (en) 2016-03-20 2016-03-20 User network behavior analysis method and device

Publications (1)

Publication Number Publication Date
CN105893462A true CN105893462A (en) 2016-08-24

Family

ID=57013758

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610172502.1A Pending CN105893462A (en) 2016-03-20 2016-03-20 User network behavior analysis method and device

Country Status (1)

Country Link
CN (1) CN105893462A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106487791A (en) * 2016-10-13 2017-03-08 深圳市深信服电子科技有限公司 Based on the application auditing system of application encapsulation, method and audit component
CN107846381A (en) * 2016-09-18 2018-03-27 阿里巴巴集团控股有限公司 Network security processing method and equipment
CN111865696A (en) * 2020-07-28 2020-10-30 深圳前海微众银行股份有限公司 Visualization method, device, equipment and medium for network security

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020178166A1 (en) * 2001-03-26 2002-11-28 Direct411.Com Knowledge by go business model
CN1578227A (en) * 2003-07-29 2005-02-09 上海聚友宽频网络投资有限公司 Dynamic IP data packet filtering method
CN1822571A (en) * 2005-02-18 2006-08-23 美国博通公司 Network apparatus and method for data processing
CN101079066A (en) * 2007-06-29 2007-11-28 深圳市中科新业信息科技发展有限公司 Network data analysis method and system in network auditing
US20100257205A1 (en) * 2002-12-31 2010-10-07 American Express Travel Related Services Company, Inc. Method and System for Implementing and Managing an Enterprise Identity Management for Distributed Security
CN101963966A (en) * 2009-07-24 2011-02-02 李占胜 Method for sorting search results by adding labels into search results
CN102880676A (en) * 2012-09-10 2013-01-16 新浪网技术(中国)有限公司 Statistical method for user behavior data and user behavior data statistical system
CN103309960A (en) * 2013-05-29 2013-09-18 亿赞普(北京)科技有限公司 Method and device for extracting multidimensional information of network public sentiment event
CN103812872A (en) * 2014-02-28 2014-05-21 中国科学院信息工程研究所 Network water army behavior detection method and system based on mixed Dirichlet process
CN103888305A (en) * 2012-12-19 2014-06-25 中国电信股份有限公司 Home gateway-based monitoring method and system
CN104394211A (en) * 2014-11-21 2015-03-04 浪潮电子信息产业股份有限公司 Hadoop-based user behavior analysis system design and implementation method

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020178166A1 (en) * 2001-03-26 2002-11-28 Direct411.Com Knowledge by go business model
US20100257205A1 (en) * 2002-12-31 2010-10-07 American Express Travel Related Services Company, Inc. Method and System for Implementing and Managing an Enterprise Identity Management for Distributed Security
CN1578227A (en) * 2003-07-29 2005-02-09 上海聚友宽频网络投资有限公司 Dynamic IP data packet filtering method
CN1822571A (en) * 2005-02-18 2006-08-23 美国博通公司 Network apparatus and method for data processing
CN101079066A (en) * 2007-06-29 2007-11-28 深圳市中科新业信息科技发展有限公司 Network data analysis method and system in network auditing
CN101963966A (en) * 2009-07-24 2011-02-02 李占胜 Method for sorting search results by adding labels into search results
CN102880676A (en) * 2012-09-10 2013-01-16 新浪网技术(中国)有限公司 Statistical method for user behavior data and user behavior data statistical system
CN103888305A (en) * 2012-12-19 2014-06-25 中国电信股份有限公司 Home gateway-based monitoring method and system
CN103309960A (en) * 2013-05-29 2013-09-18 亿赞普(北京)科技有限公司 Method and device for extracting multidimensional information of network public sentiment event
CN103812872A (en) * 2014-02-28 2014-05-21 中国科学院信息工程研究所 Network water army behavior detection method and system based on mixed Dirichlet process
CN104394211A (en) * 2014-11-21 2015-03-04 浪潮电子信息产业股份有限公司 Hadoop-based user behavior analysis system design and implementation method

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
姜亚南: "数据挖掘在校园网用户网络行为分析的应用研究", 《中国优秀硕士学位论文全文数据库 信息科技辑》 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107846381A (en) * 2016-09-18 2018-03-27 阿里巴巴集团控股有限公司 Network security processing method and equipment
CN106487791A (en) * 2016-10-13 2017-03-08 深圳市深信服电子科技有限公司 Based on the application auditing system of application encapsulation, method and audit component
CN111865696A (en) * 2020-07-28 2020-10-30 深圳前海微众银行股份有限公司 Visualization method, device, equipment and medium for network security
CN111865696B (en) * 2020-07-28 2024-05-07 深圳前海微众银行股份有限公司 Network security visualization method, device, equipment and medium

Similar Documents

Publication Publication Date Title
JP7018920B2 (en) Confidential information processing methods, devices, servers, and security decision systems
CN108628741B (en) Webpage testing method and device, electronic equipment and medium
US10812516B2 (en) Cyber security posture validation platform
US9305302B2 (en) Weighting sentiment information
CN104486461B (en) Domain name classification method and device, domain name recognition methods and system
CN103942497B (en) Forensics type website vulnerability scanning method and system
CN111177779B (en) Database auditing method, device, electronic equipment and computer storage medium
US10656907B2 (en) Translation of natural language into user interface actions
US20110238723A1 (en) Systems and methods for web decoding
CN106874761A (en) A kind of Android system malicious application detection method and system
US8185352B2 (en) Benchmarking correlated stream processing systems
CN106528393A (en) Method and device for Mock testing of WebService
CN106570399A (en) Method for detecting privacy leakage across app components
Ferreira et al. Phishing Through Time: A Ten Year Story based on Abstracts.
CN109656829A (en) Test method and device based on docker
CN103617390A (en) Malicious webpage judgment method, device and system
CN106776312B (en) The method, apparatus of cloud pressure testing data distribution calculates equipment and pressure testing system
CN107038194A (en) A kind of method for page jump and device
CN107577590A (en) Method and device based on database service real-time calling virtual interface
CN105893462A (en) User network behavior analysis method and device
CN107644161A (en) Safety detecting method, device and the equipment of sample
CN111221721A (en) Automatic recording and executing method and device for unit test cases
CN103581321B (en) A kind of creation method of refer chains, device and safety detection method and client
CN114356747A (en) Display content testing method, device, equipment, storage medium and program product
WO2017078705A1 (en) Automatic execution of objects in a user interface

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20160824