Research On Business Security Situational Awareness Technology Based On Network Traffic Analysis

With the popularization and rapid development of industrial Ethernet technology,the network attacks faced by industrial Ethernet are also increasing,which poses a serious threat to the security of industrial control networks.Due to the strong specialty of the industrial control network and its high reliability requirements for operation,the safety protection of the industrial control network has higher requirements.Situational awareness provides a way for network managers to gain an in-depth understanding of the network by assessing network situation.In order to ensure the normal and efficient operation of the industrial control network,it is extremely important to accurately grasp the network operation situation.By analyzing the network traffic flow of each service in the system and studying the security situation of each service,it can clarify the running status of different services in the network,discover various security threats in the network in time,and effectively ensure the security and stability of each service in the system.Therefore,this paper analyzes and models the network traffic,studies the security situation of different services in the network,and designs and implements the network service security situation awareness system to display the security posture in real time.Firstly,this paper studies the acquisition technology of network traffic,and designs the collection module of the system as the data source of network traffic analysis.Then,the identification technology of service traffic in the network is studied to realize the identification function of the traffic service type.In order to realize the situational awareness of business security,the modeling method and situation assessment method of network traffic are studied,and the traffic model module and situation assessment module are designed.According to the needs of business security situational awareness visualization,this paper designs the visualization module of the system.Finally,based on the system function design,the above functional modules are realized by coding,achieving the purpose of visual display of business security situation.The business security situation system designed and implemented based on the method of network traffic analysis can effectively monitor different service traffic flows in the network,evaluate the operational status of the service,and play an important role in the safe and efficient operation of the industrial control system.