Data security maintenance optimization method and system based on data analysis

Abstract

The present invention relates to the field of data security maintenance technology, and in particular to a data security maintenance optimization method and system based on data analysis. The method comprises the following steps: obtaining data analysis authority; extracting data to be analyzed according to the data analysis authority to generate data to be analyzed; performing data splitting processing on the data to be analyzed to generate split data; performing data abnormal behavior analysis on the split data to generate abnormal behavior data; performing abnormal flow analysis on the data to be analyzed according to the abnormal behavior data to obtain abnormal flow data; performing abnormal flow isolation and division processing on the abnormal flow data to generate abnormal flow isolation data; designing an abnormal data blocking strategy based on the abnormal flow isolation data; transmitting the abnormal data blocking strategy to the terminal to perform data security maintenance optimization. The present invention can achieve overall optimization and maintenance of data security.

Description

Technical Field

[0001] The present invention relates to the technical field of data security maintenance, and in particular to a data security maintenance optimization method and system based on data analysis. Background Art

[0002] In recent years, as enterprises and organizations collect and store large amounts of data, data security issues have become increasingly prominent. Traditional data security maintenance methods are difficult to meet the actual needs of large-scale, highly complex data environments. In the prior art, common data security maintenance methods mainly focus on traditional firewalls, intrusion detection systems and other infrastructure, although these methods can provide security to a certain extent. However, traditional data security maintenance methods often rely on static rules and lack the ability to flexibly respond to dynamic data environments, and are unable to accurately identify, isolate and block abnormal behavior data and traffic dynamically. Summary of the invention

[0003] Based on this, the present invention provides a data security maintenance optimization method and system based on data analysis to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a data security maintenance optimization method based on data analysis includes the following steps:

[0005] Step S1: Obtain data analysis authority; extract data to be analyzed according to the data analysis authority and generate data to be analyzed;

[0006] Step S2: performing data splitting processing according to the data to be analyzed to generate split data, performing data abnormal behavior analysis according to the split data to generate abnormal behavior data;

[0007] Step S3: performing abnormal traffic analysis on the data to be analyzed according to the abnormal behavior data to obtain abnormal traffic data;

[0008] Step S4: performing abnormal traffic isolation and division processing on the abnormal traffic data to generate abnormal traffic isolation data;

[0009] Step S5: Design an abnormal data blocking strategy based on abnormal traffic isolation data; transmit the abnormal data blocking strategy to the terminal to perform data security maintenance optimization.

[0010] The present invention obtains the data analysis authority of the third-party platform to ensure the legal access to the data and realize the security and compliance of the analysis data. Split processing is implemented according to the data to be analyzed to generate split data, thereby reducing the aggregation degree of the data, improving the sensitivity of the system to abnormal data behavior, and thus improving the efficiency of data security maintenance. According to the abnormal behavior data, abnormal traffic analysis is performed on the data to be analyzed. By deeply analyzing the traffic characteristics of the data, the abnormal traffic is made more prominent and easy to capture, and the detection of abnormal data behavior is enhanced. The abnormal traffic data is isolated and divided to achieve isolation of potential risks and effectively slow down the spread of abnormal behavior. Based on the abnormal traffic isolation data, an abnormal data blocking strategy is designed, and the strategy is transmitted to the terminal to perform data security maintenance optimization. By analyzing the abnormal data, the system generates a blacklist to mark the abnormal data, and designs a corresponding blocking strategy to reduce the impact of potential threats. In addition, the path characteristics and time series feature data are used to automatically generate abnormal blocking scripts to achieve automatic blocking of abnormal data, thereby achieving overall data security maintenance. First, by splitting the data and isolating the data, the sensitivity and detection accuracy of the system to abnormal data behavior are improved. Secondly, through traffic analysis and isolation, the system can capture and isolate potential abnormal traffic in a timely manner, effectively reducing the risk of data leakage and attack spread. Finally, by automatically generating blocking scripts, the system's response speed is improved, making it more practical and adaptive, providing strong protection for data security maintenance.

[0011] Preferably, step S1 comprises the following steps:

[0012] Step S11: Obtaining data analysis authority;

[0013] Step S12: Perform authority analysis according to the data analysis authority to generate authority analysis data;

[0014] Step S13: performing extraction range analysis of the data to be analyzed according to the authority parsing data to obtain extraction range data;

[0015] Step S14: collecting data to be analyzed according to the extracted range data to obtain the data to be analyzed.

[0016] The present invention can accurately identify and grant corresponding data access rights by performing permission analysis on data analysis rights and clearly analyzing data access rights, thereby effectively preventing unauthorized data access, and at the same time providing traceable and manageable permission control for data analysis. The extraction range of the data to be analyzed is analyzed based on the permission analysis data to obtain accurate extraction range data, ensuring targeted extraction and subsequent analysis of the data. Efficient collection of the data to be analyzed is performed based on the extraction range data, and accurate extraction of the data to be analyzed is achieved through analysis of the extraction range and efficient data collection, avoiding unauthorized access and operation. Clearly defined data range restrictions effectively prevent access to unauthorized data, protect data privacy and security, ensure accurate collection of data required for analysis, and lay a reliable foundation for subsequent data analysis work. Through reasonable permission management and data extraction processes, the legality and efficiency of the data analysis process are ensured.

[0017] Preferably, step S2 comprises the following steps:

[0018] Step S21: Perform data application module analysis on the data to be analyzed to obtain application module data;

[0019] Step S22: performing data flow frequency analysis according to the application module data to generate flow frequency data;

[0020] Step S23: performing data splitting parameter analysis according to the application module data and the flow frequency data to generate splitting parameters;

[0021] Step S24: performing data splitting processing on the data to be analyzed according to the splitting parameters to generate split data;

[0022] Step S25: Perform data abnormal behavior analysis based on the split data to generate abnormal behavior data.

[0023] The present invention analyzes the data to be analyzed by data application module, classifies the data to be analyzed according to the application module, reduces the degree of data aggregation, and helps the system to be more sensitive to abnormal data behavior. Abnormal data usually shows characteristics that are significantly different from normal behavior patterns. By analyzing and classifying the data at the application module level, the abnormal patterns of different business data can be more accurately identified, and the sensitivity and accuracy of abnormal data can be improved. The data flow frequency analysis of the application module data can be more comprehensively understood by understanding the transmission frequency and potential laws of data between different application modules, which helps to determine the appropriate data splitting parameters in the future, so as to perform data splitting processing more finely. The refined data flow frequency analysis helps the system to more accurately identify abnormal behavior. In combination with the application module data and the flow frequency data, the system generates splitting parameters suitable for different data, so that the system can more flexibly respond to different application scenarios and realize the refined control of the data splitting process. According to the splitting parameters, the data to be analyzed is processed by data splitting, and the flexible splitting of the data is realized, so that the subsequent abnormal behavior analysis is more targeted. The refined data splitting processing helps to improve the sensitivity to abnormal data behavior, so that the system can more effectively capture and identify potential abnormal situations. Perform data abnormal behavior analysis on the split data, conduct targeted in-depth analysis on each split data, perceive abnormal behavior more sensitively, accurately capture and identify potential abnormal situations, improve the accuracy of detecting potential data risks, and thus improve the security of data maintenance.

[0024] Preferably, step S25 comprises the following steps:

[0025] Step S251: Obtain data node logs of split data;

[0026] Step S252: extracting change data from the data node log to obtain change data;

[0027] Step S253: using the change data to perform change feature data analysis on the split data to generate change feature data;

[0028] Step S254: Draw a data behavior baseline based on the change feature data to generate behavior baseline data;

[0029] Step S255: Perform data behavior abnormal deviation detection based on the behavior baseline data to generate a data behavior risk coefficient;

[0030] Step S256: extract abnormal behavior data from the split data according to the data behavior risk coefficient to obtain abnormal behavior data.

[0031] The present invention extracts change data from the data node log of the split data, and the change data becomes the basis for subsequent abnormal behavior analysis, so as to accurately grasp the dynamic changes of the split data and provide real-time data support for the system to identify abnormal behavior. The change feature data analysis is performed on the change data, and the baseline of the data behavior is drawn using the change feature data. The change data is comprehensively analyzed, and statistics and processing are performed in combination with the change feature data of the change data to draw a dynamic behavior baseline that reflects normal behavior. The behavior baseline considers the normal behavior mode of the data in different time periods to ensure that the baseline can effectively reflect the data behavior under the normal operation of the system. The behavior baseline of the change feature data can not only adapt to the periodic changes of the data behavior, but also can be dynamically adjusted to adapt to the new normal behavior mode, providing a real-time and effective comparison standard for data anomaly analysis, which is helpful to accurately identify potential abnormal behavior. The data behavior abnormal deviation detection is performed according to the behavior baseline data, and the deviation of the behavior of each data node in the split data relative to the normal baseline is reflected by calculating the degree of deviation of the data behavior from the baseline, thereby identifying potential abnormal behavior. The split data is further screened and extracted for abnormal behavior data based on the generated data behavior risk coefficient. By setting appropriate thresholds, the system identifies abnormal data with risk coefficients exceeding the thresholds and marks them as abnormal behavior data, providing accurate abnormal behavior data for subsequent abnormal traffic analysis.

[0032] Preferably, step S3 comprises the following steps:

[0033] Step S31: Performing business data traffic flow direction detection according to abnormal behavior data to generate business traffic flow direction data;

[0034] Step S32: performing business data flow distribution analysis according to the business flow direction data to generate business flow distribution data;

[0035] Step S33: performing data traffic abnormal pattern analysis according to the service traffic flow direction data and the service traffic distribution data to generate abnormal traffic pattern data;

[0036] Step S34: performing abnormal traffic analysis on the data to be analyzed according to the abnormal traffic pattern data to obtain abnormal traffic data.

[0037] The present invention detects the flow direction of business data traffic on abnormal behavior data, accurately captures the transmission path of business data in the network, generates detailed business traffic flow direction data, and can accurately grasp the flow direction of business data in the network by analyzing the flow direction of business data traffic, which is helpful to identify potential abnormal behavior. Further, business data traffic distribution analysis is performed based on the business traffic flow direction data. By deeply digging into the propagation of business data in the network, the system carefully understands the distribution characteristics of different business data, and provides detailed basic data for subsequent abnormal pattern analysis. Data traffic abnormal pattern analysis is performed in combination with business traffic flow direction data and business traffic distribution data. On the basis of identifying the normal business traffic pattern, the system can more accurately detect the special pattern of abnormal traffic, thereby improving the recognition accuracy of data abnormal behavior. According to the abnormal traffic pattern data, abnormal traffic analysis is performed on the data to be analyzed. By performing comprehensive abnormal traffic detection on the data to be analyzed, the system can quickly and accurately identify potential abnormal behavior, providing strong support for further processing and isolation. Through comprehensive and in-depth traffic analysis, the system can efficiently and accurately detect abnormal traffic in a large-scale network environment, providing strong protection for data security.

[0038] Preferably, step S34 includes the following steps:

[0039] Step S341: Perform historical traffic data analysis on the data to be analyzed to generate historical traffic data;

[0040] Step S342: analyzing the abnormal traffic degree of the abnormal traffic pattern data according to the historical traffic data to generate traffic abnormality degree data;

[0041] Step S343: performing abnormal traffic analysis on the abnormal behavior data according to the traffic anomaly degree data to generate abnormal traffic data.

[0042] The present invention analyzes the historical traffic data of the data to be analyzed, and the system establishes a detailed historical traffic data set. The system can fully understand the fluctuation pattern and trend of normal business traffic, and provide a benchmark for subsequent abnormal traffic analysis. The abnormal traffic pattern data is analyzed for the abnormal degree of data traffic. By comparing the actual traffic with the historical average level, the system can quantify the abnormal degree of business traffic, effectively capture the trend of traffic changes, and have sensitive perception capabilities for abnormal traffic changes in the short term. According to the traffic abnormality degree data, the abnormal behavior data is analyzed for abnormal traffic. Based on the traffic abnormality degree data, the system can determine which business traffic deviates from the normal level at a specific time point or time period. The accurate identification of abnormal traffic helps the system distinguish between normal and abnormal traffic behaviors, and provides important information for subsequent security decisions. A progressive analysis process is formed. Through historical traffic data, abnormal degree analysis and abnormal traffic analysis, the system can more comprehensively and accurately identify and respond to various abnormal traffic situations, thereby improving the security and reliability of data security maintenance.

[0043] Preferably, step S4 comprises the following steps:

[0044] Step S41: extracting the traffic data packet of abnormal traffic data and generating a traffic data packet;

[0045] Step S42: performing traffic fingerprint identification and analysis according to the traffic data packet to generate traffic fingerprint data;

[0046] Step S43: performing abnormal traffic label processing according to the traffic fingerprint data to generate abnormal traffic label data;

[0047] Step S44: performing abnormal traffic isolation and division processing on the abnormal traffic data according to the abnormal traffic label data to generate abnormal traffic isolation data.

[0048] The present invention extracts traffic data packets of abnormal traffic data, performs fine-grained analysis on abnormal traffic of data, and captures traffic data packets to fully understand the transmission details of abnormal traffic, which is helpful for in-depth analysis of data anomalies. By performing traffic fingerprint recognition and analysis on traffic data packets, feature extraction and recognition of abnormal traffic are realized. By deeply analyzing the features of data packets, the system can accurately identify the iconic features of abnormal traffic, generate traffic fingerprint data, and use it for subsequent abnormal traffic label processing to help identify abnormal traffic behavior. By performing abnormal traffic label processing on traffic fingerprint data, marking and classification of abnormal traffic are realized, and data packets with abnormal features in traffic fingerprints are marked as abnormal traffic, so as to facilitate subsequent isolation processing. Multiple abnormal traffic labels can be established according to actual needs to improve the system's recognition accuracy of different types of abnormal traffic. By performing abnormal traffic isolation and division on abnormal traffic label data, isolation processing of abnormal traffic is realized, and data packets marked as abnormal are divided into corresponding isolation areas to prevent interference with normal data and improve the overall security and stability of data.

[0049] Preferably, step S5 comprises the following steps:

[0050] Step S51: Analyze the data content properties of the abnormal traffic isolation data to generate content property data;

[0051] Step S52: Detecting the cause of data anomaly on the traffic isolation data according to the content property data to obtain anomaly cause data;

[0052] Step S53: marking the data blacklist according to the abnormal reason data, and generating blacklist marked abnormal data;

[0053] Step S54: designing an abnormal data blocking strategy based on the abnormal data marked in the blacklist;

[0054] Step S55: Transmit the abnormal data blocking strategy to the terminal to perform data security maintenance optimization.

[0055] The present invention analyzes the data content properties of the abnormal traffic isolation data, analyzes the content of the traffic data, identifies key information, data types, etc., distinguishes normal data from abnormal data, and helps to more accurately determine data anomalies. By detecting the cause of data anomalies on the traffic isolation data according to the content property data, by analyzing the content properties of the abnormal traffic, the system detects the root cause of the anomaly, identifies the specific cause of the anomaly for each abnormal traffic data, and helps to design subsequent processing and blocking strategies. By marking the data blacklist according to the abnormal cause data, identifying potential threats according to the abnormal cause data, marking the corresponding data as blacklist data, and realizing the marking of abnormal data, the blacklist marking helps to monitor the abnormal data in real time and discover potential threats in time. By designing an abnormal data blocking strategy according to the blacklist marking abnormal data, designing a corresponding blocking strategy according to the characteristics of the blacklist data, ensuring timely and accurate response to potential threats, the blocking strategy can be adaptively adjusted according to real-time traffic and threat intelligence, and improving the flexibility of data security defense. The abnormal data blocking strategy is transmitted to the terminal to perform data security maintenance optimization, and the designed abnormal data blocking strategy is transmitted to the terminal in real time to ensure the timeliness of the blocking operation. The terminal performs data security maintenance, and improves the performance and reliability of the system for overall data security maintenance.

[0056] Preferably, step S54 includes the following steps:

[0057] Step S541: Perform spatial path analysis on the blacklist annotated abnormal data to obtain spatial path data;

[0058] Step S542: performing path feature analysis according to the spatial path data to generate path feature data;

[0059] Step S542: performing time series feature analysis on the path feature data to generate time series feature data;

[0060] Step S543: Write an automated exception blocking script based on the path feature data and the timing feature data to generate an abnormal data blocking strategy.

[0061] The present invention effectively reveals the propagation trajectory of abnormal data in the network by performing spatial path analysis on the abnormal data marked by the blacklist, further identifies the association between abnormal data and the network topology structure, helps the system to deeply understand the propagation behavior of abnormal data, and provides substantial data support for formulating corresponding blocking strategies. According to the spatial path data, path feature analysis can be performed to fully understand the path characteristics of abnormal data in the network, which helps to discover the propagation law and path mode of abnormal data in the network, and provides the system with more accurate and targeted path feature data. The path feature data is analyzed for time series characteristics, and the time series characteristic analysis enables the system to understand the dynamic changes of the propagation path of abnormal data in more detail, provides key information of time series changes for subsequent abnormal data blocking strategies, and helps to take flexible and effective blocking measures in different time periods. Based on the path feature data and the time series feature data, an automated abnormal blocking script is written, and the path feature and the time series feature are combined to design a targeted and efficient blocking script according to the path and time series change law of abnormal data propagation, so as to ensure that the particularity of its propagation path and the regularity of time series changes are fully considered when blocking abnormal data, so as to realize intelligent blocking of abnormal data, improve the response speed of the whole system to abnormal behavior, and effectively protect the security of data.

[0062] This specification provides a data security maintenance optimization system based on data analysis, which is used to execute the data security maintenance optimization method based on data analysis as described above. The data security maintenance optimization system based on data analysis includes:

[0063] The data collection module for analysis is used to obtain data analysis permissions; extract the data to be analyzed according to the data analysis permissions and generate the data to be analyzed;

[0064] The data abnormal behavior analysis module is used to perform data splitting processing according to the data to be analyzed, generate split data, perform data abnormal behavior analysis according to the split data, and generate abnormal behavior data;

[0065] The data abnormal flow analysis module is used to analyze the data abnormal flow according to the abnormal behavior data to obtain abnormal flow data;

[0066] The data abnormal traffic isolation module is used to perform abnormal traffic isolation and division processing on abnormal traffic data to generate abnormal traffic isolation data;

[0067] The data security maintenance module is used to design abnormal data blocking strategies based on abnormal traffic isolation data; the abnormal data blocking strategies are transmitted to the terminal to perform data security maintenance optimization.

[0068] The beneficial effect of the present application is that the data security maintenance optimization method based on data analysis of the present invention ensures legal access to data by obtaining data analysis permissions, and realizes the security and compliance of data access and analysis. The data to be analyzed is split and processed to generate split data, thereby reducing the degree of data aggregation, so as to better analyze and identify abnormal behavior data. According to the abnormal behavior data, abnormal traffic analysis is performed on the data to be analyzed, and the traffic characteristics of the data are deeply analyzed, so that the abnormal traffic data is more prominent and easy to capture, and potential abnormal behavior patterns are identified, and the detection of abnormal behavior data is enhanced. The abnormal traffic data is isolated and divided to achieve isolation of potential data risks and effectively slow down the spread of abnormal behavior data. Based on the abnormal traffic isolation data, an abnormal data blocking strategy is designed, and the strategy is transmitted to the terminal to perform data security maintenance optimization, which improves the system data security maintenance response speed, makes the system more real-time and adaptive, and provides strong support for data security. Accurate analysis, identification and isolation of abnormal data and traffic are achieved, providing more effective protection for data security maintenance, improving data security and system stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A schematic diagram of the steps of a data security maintenance optimization method based on data analysis according to the present invention;

[0070] Figure 2 for Figure 1 Detailed implementation steps of step S1 in FIG.

[0071] Figure 3 for Figure 1 Detailed implementation steps of step S2 in the flowchart;

[0072] Figure 4 for Figure 1 Detailed implementation steps of step S3 in FIG.

[0073] Figure 5 for Figure 1 Detailed implementation steps of step S4 in FIG.

[0074] Figure 6 for Figure 1 Detailed implementation steps of step S5;

[0075] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0076] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0077] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities are implemented in software form, or in one or more hardware modules or integrated circuits, or in different network and / or processor methods and / or microcontroller methods.

[0078] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiment, the first unit is referred to as the second unit, and similarly the second unit is referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0079] To achieve this, please refer to Figures 1 to 6 The present invention provides a data security maintenance optimization method based on data analysis, comprising the following steps:

[0080] Step S1: Obtain data analysis authority; extract data to be analyzed according to the data analysis authority and generate data to be analyzed;

[0081] Step S2: performing data splitting processing according to the data to be analyzed to generate split data, performing data abnormal behavior analysis according to the split data to generate abnormal behavior data;

[0082] Step S3: performing abnormal traffic analysis on the data to be analyzed according to the abnormal behavior data to obtain abnormal traffic data;

[0083] Step S4: performing abnormal traffic isolation and division processing on the abnormal traffic data to generate abnormal traffic isolation data;

[0084] Step S5: Design an abnormal data blocking strategy based on abnormal traffic isolation data; transmit the abnormal data blocking strategy to the terminal to perform data security maintenance optimization.

[0085] The present invention ensures legal access to data by obtaining data analysis permissions, thereby achieving security and compliance of analysis data. Split processing is performed according to the data to be analyzed to generate split data, thereby reducing the degree of data aggregation and improving the sensitivity of the system to abnormal data behavior. Abnormal traffic analysis is performed on the data to be analyzed according to the abnormal behavior data, and the abnormal traffic is made more prominent and easy to capture by deeply analyzing the traffic characteristics of the data, thereby enhancing the detection of abnormal data behavior. The abnormal traffic data is isolated and divided to achieve isolation of potential risks and effectively slow down the spread of abnormal behavior. An abnormal data blocking strategy is designed based on the abnormal traffic isolation data, and the strategy is transmitted to the terminal to perform data security maintenance optimization. By analyzing the abnormal data, the system generates a blacklist to mark the abnormal data, and designs corresponding blocking strategies to reduce the impact of potential threats. In addition, the path characteristics and time series feature data are used to automatically generate abnormal blocking scripts to achieve automatic blocking of abnormal data. First, by splitting the data and isolating the processing, the sensitivity and detection accuracy of the system to abnormal data behavior are improved. Secondly, through traffic analysis and isolation division, the system can capture and isolate potential abnormal traffic in a timely manner, effectively reducing the risk of data leakage and attack spread. Finally, by automatically generating blocking scripts, the system's response speed is improved, making it more practical and adaptive, providing strong protection for data security maintenance.

[0086] In the embodiment of the present invention, reference Figure 1 The above is a schematic diagram of the steps of a data security maintenance optimization method based on data analysis of the present invention. In this embodiment, the data security maintenance optimization method based on data analysis includes the following steps:

[0087] Step S1: Obtain data analysis authority; extract data to be analyzed according to the data analysis authority and generate data to be analyzed;

[0088] In an embodiment of the present invention, to obtain data analysis permissions for a company or enterprise, first submit detailed data analysis project information, including the purpose and scope of the analyzed data. The company or enterprise grants data analysis permissions of different permissions based on the data analysis project information to ensure legal access and security of the data. By adopting modern identity authentication and authorization technologies, such as OAuth or LDAP, secure permission management is achieved. When the identity is correctly verified, a corresponding access token is generated or specific user permissions are assigned, which not only ensures the security and compliance of data access, but also provides traceable and manageable permission control for data analysis, laying a reliable foundation for subsequent data extraction. Accurate data scope identification and extraction are performed through clearly defined data analysis permissions, ensuring that only data within the permission scope is extracted, avoiding unauthorized access, ensuring the security of data access and the accuracy of permissions, and ensuring the compliance and security of data acquisition and analysis.

[0089] Step S2: performing data splitting processing according to the data to be analyzed to generate split data, performing data abnormal behavior analysis according to the split data to generate abnormal behavior data;

[0090] In the embodiment of the present invention, by splitting the data to be analyzed, a large amount of aggregated data is subdivided according to specific dimensions or application functions. For example, the data to be analyzed is split according to different application modules, so that each split data is more focused on a specific business field, which not only optimizes the structure of the data to be analyzed, makes abnormal data easier to find, and reduces the difficulty of detecting abnormal data, but also provides a clearer and more targeted data basis for subsequent data abnormal behavior analysis. Data abnormal behavior analysis is performed on the split data, by collecting the data node logs of each split data set, including information such as data changes, access and operations, extracting the changed data from the data node logs, analyzing the data change characteristics, and using the change characteristic data to draw the baseline of the data behavior. Through the comprehensive analysis of the change characteristic data and the behavior baseline, not only the anomalies of a single variable can be captured, but also the complex abnormal behaviors of multiple dimensions can be identified, which improves the sensitivity to data abnormal behavior and the accuracy of detection, and improves the quality and accuracy of data abnormal behavior analysis.

[0091] Step S3: performing abnormal traffic analysis on the data to be analyzed according to the abnormal behavior data to obtain abnormal traffic data;

[0092] In an embodiment of the present invention, abnormal traffic analysis is performed on the data to be analyzed based on the abnormal behavior data. For example, the flow of business data involved in the network traffic is detected, and the distribution of the business data traffic is analyzed. In combination with the business data flow, it is identified whether there is an abnormal data traffic pattern. In combination with the historical traffic data of the data to be analyzed, the past traffic conditions of the business are understood. By using the historical traffic data as a reference, the abnormal degree of abnormal traffic can be more accurately assessed, making the abnormal traffic data more credible and practical. Abnormal traffic analysis is performed on the abnormal behavior data to determine the specific data business traffic abnormality so that appropriate response and processing can be carried out, and it is helpful to timely discover and solve potential problems.

[0093] Step S4: performing abnormal traffic isolation and division processing on the abnormal traffic data to generate abnormal traffic isolation data;

[0094] In an embodiment of the present invention, abnormal traffic data is isolated and divided for abnormal traffic processing, and it is detected that a certain IP address sends abnormal traffic in a short period of time, and the traffic data packets of the IP address are extracted, including source IP, target IP, port number, transmission protocol and other information. Traffic fingerprint recognition technology is used to analyze these data packets for protocol type and data packet size, and traffic fingerprint data is generated. Data that meets the traffic fingerprint data is marked as abnormal traffic and given an abnormal traffic label. The traffic data marked as abnormal is isolated from the overall data, and significant abnormal situations are quickly responded to and isolated, thereby improving data security and providing a basis for subsequent data security maintenance measures.

[0095] Step S5: Design an abnormal data blocking strategy based on abnormal traffic isolation data; transmit the abnormal data blocking strategy to the terminal to perform data security maintenance optimization.

[0096] In an embodiment of the present invention, an abnormal data blocking strategy is designed based on abnormal traffic isolation data. Taking network data transmission as an example, the abnormal traffic isolation data is analyzed for content properties, and it is found that a large number of executable files are contained therein. Through data anomaly cause detection, it is confirmed that these files are actually the spread of malware, and corresponding abnormal cause data is generated. The traffic related to the malware is marked as blacklist abnormal data, and a blocking strategy is designed according to the blacklist abnormal data to block IP addresses, ports and file transfer protocols related to the malware to form a detailed blocking list. The abnormal data blocking strategy is designed according to the blocking list, and the designed abnormal data blocking strategy is transmitted to the terminal for execution, and the blocking is implemented through network equipment or firewalls. The designed abnormal data blocking strategy is transmitted to the terminal for execution, and the blocking is implemented through network equipment. By accurately identifying and isolating abnormal traffic spread by malware, the overall security of the data is effectively protected.

[0097] Preferably, step S1 comprises the following steps:

[0098] Step S11: Obtaining data analysis authority;

[0099] Step S12: Perform authority analysis according to the data analysis authority to generate authority analysis data;

[0100] Step S13: performing extraction range analysis of the data to be analyzed according to the authority parsing data to obtain extraction range data;

[0101] Step S14: collecting data to be analyzed according to the extracted range data to obtain the data to be analyzed.

[0102] The present invention first obtains the data analysis authority of the company or enterprise to ensure that it has legal data access rights, generates detailed authority analysis data through authority analysis, realizes clear analysis of data access rights, and can accurately identify and grant corresponding data access rights, thereby effectively preventing unauthorized data access. According to the authority analysis data, the extraction range of the data to be analyzed is analyzed to obtain accurate extraction range data, ensuring targeted extraction and subsequent analysis of the data. According to the extraction range data, the data to be analyzed is efficiently collected, and through the analysis of the extraction range and efficient data collection, the accuracy of the data required for analysis is ensured, which lays a reliable foundation for subsequent data analysis work. Through reasonable authority management and data extraction process, the legitimacy and efficiency in the data analysis process are ensured, and at the same time, traceable and manageable authority control is provided for data analysis.

[0103] As an example of the present invention, refer to Figure 2 As shown, Figure 1 Detailed implementation steps of step S1 in the flowchart, in this example, step S1 includes:

[0104] Step S11: Obtaining data analysis authority;

[0105] In an embodiment of the present invention, the company or enterprise data analysis authority is obtained, and its legal identity proof is provided through identity authentication. OAuth or LDAP, etc. are used to ensure that legal users can access relevant data safely and controllably. After successful identity authentication, the system generates a corresponding access token or assigns specific data analysis permissions to the user, identifies and extracts data ranges through clearly defined permissions, and generates a traceable and manageable permission control record at the same time, providing traceable and manageable permission control for data analysis.

[0106] Step S12: Perform authority analysis according to the data analysis authority to generate authority analysis data;

[0107] In an embodiment of the present invention, permission parsing is performed based on data analysis permissions. By parsing the information in the access token, the scope of permissions possessed by the user is identified. For example, the access token includes information such as accessed data tables and fields and performed operations. The generated permission parsing data ensures that in the subsequent data extraction process, the user can only access the data for which he or she is granted permission, thereby achieving security and compliance of data access.

[0108] Step S13: performing extraction range analysis of the data to be analyzed according to the authority parsing data to obtain extraction range data;

[0109] In the embodiment of the present invention, the extraction scope of the data to be analyzed is analyzed based on the permission parsing data, the accessed data tables and allowed operations are determined, and it is ensured that only the data scope for which the authority is granted can be accessed, thereby achieving accurate extraction of the data to be analyzed and avoiding unauthorized access and operations. The clearly defined data range restrictions effectively prevent access to unauthorized data, protect the privacy and security of the data, and lay a safe and controllable foundation for data analysis.

[0110] Step S14: collecting data to be analyzed according to the extracted range data to obtain the data to be analyzed.

[0111] In the embodiment of the present invention, the data to be analyzed is collected based on the extraction range data, thereby ensuring the accuracy of data collection. The system only extracts the data tables for which permissions are granted, and performs corresponding associated operations based on business needs, thereby achieving effective collection of data within the permissions, avoiding access to unauthorized data, and ensuring the security and compliance of data collection.

[0112] Preferably, step S2 comprises the following steps:

[0113] Step S21: Perform data application module analysis on the data to be analyzed to obtain application module data;

[0114] Step S22: performing data flow frequency analysis according to the application module data to generate flow frequency data;

[0115] Step S23: performing data splitting parameter analysis according to the application module data and the flow frequency data to generate splitting parameters;

[0116] Step S24: performing data splitting processing on the data to be analyzed according to the splitting parameters to generate split data;

[0117] Step S25: Perform data abnormal behavior analysis based on the split data to generate abnormal behavior data.

[0118] The present invention analyzes the data to be analyzed by data application module, classifies the data to be analyzed according to the application module, reduces the degree of data aggregation, and helps the system to be more sensitive to abnormal data behavior. Abnormal data usually shows characteristics that are significantly different from normal behavior patterns. By analyzing and classifying the data at the application module level, the abnormal patterns of different data can be more accurately identified, and the sensitivity and accuracy of abnormal data can be improved. The data flow frequency analysis is performed on the application module data, and the application module data is deeply analyzed using time series analysis, statistical methods or machine learning models, etc. By understanding the transmission frequency and potential laws of data between different application modules, the flow of data can be more comprehensively understood, which is helpful for determining appropriate data splitting parameters in the future, so as to perform data splitting processing more finely. The refined data flow frequency analysis helps the system to identify abnormal behavior more accurately. In combination with the application module data and the flow frequency data, the system generates splitting parameters suitable for different data, for example, determining the time window of splitting, the threshold of data flow, etc., so that the system can more flexibly cope with different application scenarios and realize the refined control of the data splitting process. Data to be analyzed is split according to the splitting parameters to achieve flexible data splitting, making subsequent abnormal behavior analysis more targeted. Refined data splitting helps to improve the sensitivity to data abnormal behavior, so that the system can more effectively capture and identify potential abnormal situations. Data abnormal behavior analysis is performed on the split data, and each split data is analyzed in depth. The abnormal behavior is more sensitively perceived, and potential abnormal situations can be accurately captured and identified, which improves the accuracy of detecting potential data risks, thereby improving the security of data maintenance.

[0119] As an example of the present invention, refer to Figure 3 As shown, Figure 1 Detailed implementation steps of step S2 in the embodiment are shown in the flowchart. In this embodiment, step S2 includes:

[0120] Step S21: Perform data application module analysis on the data to be analyzed to obtain application module data;

[0121] In the embodiment of the present invention, the data to be analyzed is analyzed by data application module. For example, multiple application modules support different business functions, including human resource management, financial system and production management. For the human resource management module, the system focuses on analyzing employee login, resignation, promotion and other activity data. For the financial system, the system focuses on capital flow, transaction records and other data. The data to be analyzed is subdivided into different application module data. By analyzing the data of different modules, the system can more accurately analyze the characteristics and behavior patterns of each module, providing more targeted data support for abnormal behavior analysis.

[0122] Step S22: performing data flow frequency analysis according to the application module data to generate flow frequency data;

[0123] In an embodiment of the present invention, data flow frequency analysis is performed based on application module data. For example, in an enterprise's financial system module, which involves the flow of funds and transaction records, when performing data flow frequency analysis, the system will pay attention to the transaction frequency between specific accounts and the speed of fund flow. For example, the transaction frequency is analyzed once an hour to detect whether there are abnormal high-frequency or low-frequency transactions. In combination with actual business scenarios, the data flow frequency is analyzed in detail to make the system more sensitive to abnormal data, able to promptly detect existing abnormal situations, and improve the system's ability to perceive and respond to potential risks.

[0124] Step S23: performing data splitting parameter analysis according to the application module data and the flow frequency data to generate splitting parameters;

[0125] In an embodiment of the present invention, data splitting parameter analysis is performed based on application module data and flow frequency data. Taking sales data as an example, key business parameters such as commodity category, region, etc. are identified through application module data, which can reflect the business characteristics of the data. Combined with the changes in flow frequency data at different times and frequencies, splitting parameters are formed more specifically to improve the quality of split data. When generating splitting parameters, not only the actual needs of the business are considered, but also the dynamic characteristics of the data are combined to make the splitting parameters more representative and targeted, and the data to be analyzed can be split more accurately, providing more in-depth basic data for abnormal behavior analysis, while reducing the difficulty of abnormal data analysis, thereby improving the reliability of data security maintenance.

[0126] Step S24: performing data splitting processing on the data to be analyzed according to the splitting parameters to generate split data;

[0127] In an embodiment of the present invention, data to be analyzed is split according to splitting parameters. For example, in a communication data analysis scenario of a telecom operator, the splitting parameters include communication application modules (such as voice calls, text messages, data traffic, etc.) and flow frequency data (indicating communication activity, such as high, medium, and low activity). For the voice call application module, the system generates three subsets of high, medium, and low activity, each subset including all voice call records under the corresponding activity. For other application modules, such as text messages and data traffic, the system generates corresponding subsets, thereby realizing multi-dimensional splitting of the data to be analyzed, so that the characteristics and abnormal conditions of each subset data can be more accurately observed in the subsequent abnormal behavior analysis, thereby improving the flexibility and granularity of data analysis, and being able to identify potential abnormal behaviors in a more targeted manner, thereby improving the accuracy of the overall data analysis.

[0128] Step S25: Perform data abnormal behavior analysis based on the split data to generate abnormal behavior data.

[0129] In an embodiment of the present invention, data abnormal behavior analysis is performed on the split data. For example, a department suddenly generates a large amount of data transmission during non-working hours, or the number of connections of a department is much higher than the average level. The system can accurately capture abnormal department-level network behavior in the enterprise network. Refined abnormal behavior analysis helps enterprises to promptly discover potential security issues, improve sensitivity and accuracy to abnormal network behavior, and provide a reliable basis for subsequent security defense strategies.

[0130] Preferably, step S25 comprises the following steps:

[0131] Step S251: Obtain data node logs of split data;

[0132] Step S252: extracting change data from the data node log to obtain change data;

[0133] Step S253: using the change data to perform change feature data analysis on the split data to generate change feature data;

[0134] Step S254: Draw a data behavior baseline based on the change feature data to generate behavior baseline data;

[0135] Step S255: Perform data behavior abnormal deviation detection based on the behavior baseline data to generate a data behavior risk coefficient;

[0136] Step S256: extract abnormal behavior data from the split data according to the data behavior risk coefficient to obtain abnormal behavior data.

[0137] The present invention extracts the data change situation of each department in different time periods by extracting the change data of the data node log of the split data, including the change data of the upstream and downstream traffic, the number of connections, etc. The change data becomes the basis of the subsequent abnormal behavior analysis, realizes the accurate grasp of the dynamic change of the split data, and provides real-time data support for the system to identify abnormal behavior. The change characteristic data analysis is performed on the change data, including the characteristics of the fluctuation trend of the data, the change law of the peak period, etc., and the baseline of the data behavior is drawn using the change characteristic data. The change data is comprehensively analyzed, including the fluctuation of data traffic, the change of the number of connections, the transmission rate and other key indicators, combined with the change characteristic data of the change data, statistics and processing are performed, and a dynamic behavior baseline reflecting normal behavior is drawn. The behavior baseline considers the normal behavior mode of the data in different time periods to ensure that the baseline can effectively reflect the data behavior under the normal operation of the system. The behavior baseline of the change characteristic data can not only adapt to the periodic changes of the data behavior, but also can be dynamically adjusted to adapt to the new normal behavior mode, providing a real-time and effective comparison standard for data abnormal analysis, which is helpful to accurately identify potential abnormal behavior. Data behavior abnormal deviation detection is performed based on behavioral baseline data. By calculating the degree of deviation of data behavior from the baseline, the deviation of the behavior of each data node in the split data relative to the normal baseline is reflected, thereby identifying potential abnormal behavior. The split data is further screened and extracted based on the generated data behavior risk coefficient. By setting appropriate thresholds, the system identifies abnormal data with risk coefficients exceeding the threshold and marks it as abnormal behavior data, providing accurate abnormal behavior data for subsequent abnormal traffic analysis.

[0138] In the embodiment of the present invention, the data node log of the split data is obtained. The log contains key information of the split data at different time points, such as data volume, transmission rate, etc. The data node log is subjected to change data extraction. By comparing the log records of adjacent time points, the data change volume in each time period is calculated. For example, at a certain moment, the data transmission volume of department A increases by 50GB compared with the previous moment, which is part of the change data. The obtained change data is used to analyze the change characteristic data of the split data. By statistically analyzing the mean, standard deviation, and even more complex fluctuation patterns of the data changes of each department, a data behavior baseline is drawn based on the change characteristic data to establish a dynamic baseline reflecting normal behavior. The baseline not only takes into account the change trend of the data, but also can adapt to the normal behavior patterns in different time periods. The data behavior abnormal deviation is detected based on the behavior baseline data. For example, at a certain time point, the data change of a department exceeds the normal range of the baseline, and the system will generate a corresponding data behavior risk coefficient. According to the data behavior risk coefficient, the split data is extracted for abnormal behavior data, and appropriate thresholds are set. The system identifies data whose risk coefficient exceeds the threshold and marks its data as abnormal behavior data. For example, if the risk coefficient of a department exceeds the set threshold at multiple time points, the system considers that the department has abnormal behavior. By analyzing the change characteristics of the split data and establishing a behavior baseline, and using the data behavior baseline, the system quickly captures abnormal behavior, improves the accuracy of data anomaly detection, and improves data security and analysis efficiency.

[0139] Preferably, step S3 comprises the following steps:

[0140] Step S31: Performing business data flow direction detection according to abnormal behavior data to generate business data flow direction data;

[0141] Step S32: performing business data flow distribution analysis according to the business flow direction data to generate business flow distribution data;

[0142] Step S33: performing data traffic abnormality pattern analysis according to the service traffic flow direction data and the service traffic distribution data to generate abnormal traffic pattern data;

[0143] Step S34: performing abnormal traffic analysis on the data to be analyzed according to the abnormal traffic pattern data to obtain abnormal traffic data.

[0144] The present invention detects the flow direction of business data traffic on abnormal behavior data, accurately captures the transmission path of business data in the network, generates detailed business traffic flow direction data, and can accurately grasp the flow direction of business data in the network by analyzing the flow direction of business data traffic, which is helpful to identify potential abnormal behavior data. Further, business data traffic distribution analysis is performed based on the business traffic flow direction data. By deeply digging into the propagation of business data in the network, the system carefully understands the distribution characteristics of different business data, and provides detailed basic data for subsequent abnormal pattern analysis. Combined with business traffic flow direction data and business traffic distribution data, data traffic abnormal pattern analysis is performed. On the basis of identifying the normal business traffic pattern, the system can more accurately detect the special pattern of abnormal traffic, thereby improving the recognition accuracy of abnormal behavior. According to the abnormal traffic pattern data, abnormal traffic analysis is performed on the data to be analyzed. By performing comprehensive abnormal traffic detection on the data to be analyzed, the system can quickly and accurately identify potential abnormal behavior, providing strong support for further processing and isolation. Through comprehensive and in-depth traffic analysis, the system can efficiently and accurately detect abnormal traffic in a large-scale network environment, providing strong protection for data security maintenance.

[0145] As an example of the present invention, refer to Figure 4 As shown, Figure 1 Detailed implementation steps of step S3 in the flowchart, in this example, step S3 includes:

[0146] Step S31: Performing business data flow direction detection according to abnormal behavior data to generate business data flow direction data;

[0147] In an embodiment of the present invention, business data traffic flow direction detection is performed based on abnormal behavior data. For example, the system monitors data transmission in the network, paying special attention to business data related to abnormal behavior. For example, on an e-commerce platform, abnormal behavior is that users frequently download a large number of product images in a short period of time, while normal behavior is that users browse products and view details one by one. Through deep data packet inspection technology, the business data flow direction is analyzed, and the business data flow related to the abnormal behavior is identified. The generated business traffic flow direction data will clearly show the transmission path of the abnormal behavior in the network, providing a basis for subsequent abnormal traffic analysis.

[0148] Step S32: performing business data flow distribution analysis according to the business flow direction data to generate business flow distribution data;

[0149] In an embodiment of the present invention, business data traffic distribution analysis is performed based on business traffic flow data. For example, taking an online video platform as an example, abnormal behavior is that a certain video is frequently played by a large number of users in a short period of time, while normal behavior is that the distribution of users watching videos is relatively uniform. By analyzing information such as the video ID, user ID, and access time in the data packet, the system can accurately record the number of times each video is played and the playback position. Furthermore, by statistics and analysis of these data, business traffic distribution data is generated, which provides a basis for subsequent abnormal traffic pattern analysis and helps the system better identify abnormal data behavior.

[0150] Step S33: performing data traffic abnormality pattern analysis according to the service traffic flow direction data and the service traffic distribution data to generate abnormal traffic pattern data;

[0151] In an embodiment of the present invention, data traffic abnormal pattern analysis is performed based on business traffic flow direction data and business traffic distribution data. By analyzing the internal website access data of each department, including information such as access frequency, access time period, specific pages visited, etc., statistical and machine learning techniques are used to establish a normal internal website access pattern for each department, such as the daily peak access time period, average number of visits, etc. The actually observed traffic data is compared with the established normal pattern, and the generated abnormal traffic pattern data will reflect the abnormal pattern of the department's internal website access behavior. Data traffic abnormal pattern analysis is performed based on business traffic flow direction data and business traffic distribution data, which is helpful for subsequent dynamic analysis of abnormal traffic data. In actual applications, adjustments are made according to specific scenarios and needs.

[0152] Step S34: performing abnormal traffic analysis on the data to be analyzed according to the abnormal traffic pattern data to obtain abnormal traffic data.

[0153] In the embodiment of the present invention, abnormal traffic analysis is performed on the data to be analyzed based on the abnormal traffic pattern data. The system monitors the data transmission in the entire network, including the communication between each IP address, the usage of the port, the size of the data packet and other information. By setting the rules and thresholds defined in the abnormal traffic pattern data, the system identifies those traffics that are significantly different from normal behavior. If the amount of data transmitted by a certain IP address in a short period of time exceeds twice its average value, it is considered abnormal. The abnormal traffic data will be recorded and marked, including the IP address that triggered the abnormality, the specific abnormal behavior, the time when the abnormality occurred and other information. By performing abnormal traffic analysis on the data to be analyzed based on the abnormal traffic pattern data, the system can timely and accurately identify abnormal traffic behavior in the network, which helps to improve the security of data maintenance.

[0154] Preferably, step S34 includes the following steps:

[0155] Step S341: Perform historical traffic data analysis on the data to be analyzed to generate historical traffic data;

[0156] Step S342: analyzing the abnormal traffic degree of the abnormal traffic pattern data according to the historical traffic data to generate traffic abnormality degree data;

[0157] Step S343: performing abnormal traffic analysis on the abnormal behavior data according to the traffic anomaly degree data to generate abnormal traffic data.

[0158] The present invention analyzes the historical traffic data of the data to be analyzed, and the system establishes a detailed historical traffic data set, including the change trend, peak period and valley period of the business traffic in the past time period. The system can fully understand the fluctuation pattern and trend of normal business traffic, and provide a benchmark for subsequent abnormal traffic analysis. The abnormal traffic pattern data is analyzed for the abnormal degree of data traffic. By comparing the actual traffic with the historical average level, the system can quantify the abnormal degree of business traffic, effectively capture the change trend of traffic, and have sensitive perception ability for abnormal traffic changes in the short term. According to the abnormal degree of traffic data, the abnormal behavior data is analyzed for abnormal traffic. Based on the abnormal degree of traffic data, the system can determine which business traffic deviates from the normal level at a specific time point or time period, and accurately identify abnormal traffic, help the system distinguish between normal and abnormal traffic behaviors, and provide important information for subsequent security decisions. A progressive analysis process is formed. Through historical traffic data, abnormal degree analysis and abnormal traffic analysis, the system can more comprehensively and accurately identify and respond to various abnormal traffic situations, and improve the security and reliability of data security maintenance.

[0159] In the embodiment of the present invention, historical traffic data analysis is performed on the data to be analyzed. The system collects traffic data in the past week, including daily peak values, valley values, average values, and the distribution of business traffic in different time periods. For example, a certain application has a significant increase in traffic between 9 am and 11 am on weekdays, but is relatively stable on weekend nights. The historical traffic data set provides a data basis for subsequent abnormal analysis. The abnormal traffic pattern data is analyzed for data traffic abnormality based on historical traffic data. The system calculates the difference between hourly traffic and historical average traffic in the corresponding time period to quantify the abnormal degree of traffic. For example, a traffic of 30% higher than the historical average value in a certain period is considered as moderate abnormality, and a traffic of 50% higher is considered as highly abnormal, which provides a metric for subsequent abnormal traffic analysis. Abnormal traffic analysis is performed on abnormal behavior data based on traffic abnormality data to identify abnormal behaviors that occur in highly abnormal time periods, such as abnormal data transmission rates, number of connections, or frequent specific requests. By analyzing the association between abnormal behavior data and traffic abnormality, the system can accurately locate abnormal events and provide detailed abnormal traffic data reports. Ensure that the system has an in-depth understanding of historical traffic. By quantifying the degree of traffic anomalies and combining them with abnormal behavior data, the system can efficiently and accurately identify and respond to various types of abnormal traffic situations, thereby improving the security and reliability of data security maintenance.

[0160] Preferably, step S4 comprises the following steps:

[0161] Step S41: extracting the traffic data packet of abnormal traffic data and generating a traffic data packet;

[0162] Step S42: performing traffic fingerprint identification and analysis according to the traffic data packet to generate traffic fingerprint data;

[0163] Step S43: performing abnormal traffic label processing according to the traffic fingerprint data to generate abnormal traffic label data;

[0164] Step S44: performing abnormal traffic isolation and division processing on the abnormal traffic data according to the abnormal traffic label data to generate abnormal traffic isolation data.

[0165] The present invention realizes fine-grained analysis of abnormal traffic data by extracting traffic data packets of abnormal traffic data, and comprehensively understands the transmission details of abnormal traffic by capturing traffic data packets, which is helpful for in-depth analysis. By performing traffic fingerprint recognition and analysis on traffic data packets, feature extraction and recognition of abnormal traffic are realized. By deeply analyzing the features of data packets, the system can accurately identify the iconic features of abnormal traffic, generate traffic fingerprint data, and use it for subsequent abnormal traffic label processing to help identify abnormal traffic behavior. By performing abnormal traffic label processing on traffic fingerprint data, marking and classification of abnormal traffic are realized, and data packets with abnormal features in traffic fingerprints are marked as abnormal traffic, so as to facilitate subsequent isolation processing. Multiple abnormal traffic labels can be established according to actual needs to improve the system's recognition accuracy of different types of abnormal traffic. By performing abnormal traffic isolation and division on abnormal traffic label data, isolation processing of abnormal traffic data is realized, and data packets marked as abnormal are divided into corresponding isolation areas to prevent interference with normal network traffic and improve the overall security and stability of data.

[0166] As an example of the present invention, refer to Figure 5 As shown, Figure 1 Detailed implementation steps of step S4 in the embodiment are shown in the flowchart. In this embodiment, step S4 includes:

[0167] Step S41: extracting the traffic data packet of abnormal traffic data and generating a traffic data packet;

[0168] In the embodiment of the present invention, traffic data packets are extracted from abnormal traffic data. The system extracts relevant traffic data packets from the abnormal traffic data, and captures key information including source address, destination address, port information, protocol type, etc. For example, relevant TCP and UDP data packets are extracted from an abnormal network connection, and the source IP, destination IP, source port, destination port, and transmitted data content are obtained. By extracting traffic data packets of abnormal traffic data, fine-grained analysis of abnormal data traffic is achieved.

[0169] Step S42: performing traffic fingerprint identification and analysis according to the traffic data packet to generate traffic fingerprint data;

[0170] In the embodiment of the present invention, based on the extracted traffic data packets, the system generates corresponding traffic fingerprint data by deeply analyzing the characteristics of the data packets, including the length, flag bit, and payload content of the data packets. For example, by detecting the specific flags of HTTP requests, the system identifies the traffic fingerprint of an abnormal request and then analyzes the abnormal characteristics thereof. Traffic fingerprint identification and analysis is performed on the traffic data packets to achieve feature extraction and identification of abnormal traffic.

[0171] Step S43: performing abnormal traffic label processing according to the traffic fingerprint data to generate abnormal traffic label data;

[0172] In the embodiment of the present invention, the traffic fingerprint data is processed with abnormal traffic labels. The system uses the abnormal features in the traffic fingerprint data to label each data packet with a corresponding abnormal traffic label. For example, if the traffic fingerprint contains suspicious malicious behavior features, the system labels it with a "malicious traffic" label. By processing the traffic fingerprint data with abnormal traffic labels, the marking and classification of abnormal data traffic is achieved.

[0173] Step S44: performing abnormal traffic isolation and division processing on the abnormal traffic data according to the abnormal traffic label data to generate abnormal traffic isolation data.

[0174] In the embodiment of the present invention, the abnormal traffic data is isolated and divided according to the abnormal traffic label data, and the system divides the corresponding data packets into different isolation areas according to the abnormal traffic labels to achieve the isolation of abnormal traffic. For example, the data packets marked as "malicious traffic" are isolated into a special malicious traffic isolation area to ensure that they do not affect the normal network traffic. By performing abnormal traffic isolation and division on the data abnormal traffic label data, the isolation processing of the abnormal traffic data is achieved, and the abnormal traffic is isolated in a targeted manner according to the abnormal traffic label to protect the overall security and stability of the data.

[0175] Preferably, step S5 comprises the following steps:

[0176] Step S51: Analyze the data content properties of the abnormal traffic isolation data to generate content property data;

[0177] Step S52: Detecting the cause of data anomaly on the traffic isolation data according to the content property data to obtain anomaly cause data;

[0178] Step S53: marking the data blacklist according to the abnormal reason data, and generating blacklist marked abnormal data;

[0179] Step S54: designing an abnormal data blocking strategy based on the abnormal data marked in the blacklist;

[0180] Step S55: Transmit the abnormal data blocking strategy to the terminal to perform data security maintenance optimization.

[0181] The present invention analyzes the data content properties of the abnormal traffic isolation data, analyzes the content of the traffic data, identifies key information, data types, etc., distinguishes normal data from abnormal data, and helps to more accurately determine data anomalies. By detecting the cause of data anomalies on the traffic isolation data according to the content property data, by analyzing the content properties of the abnormal traffic, the system detects the root cause of the anomaly, and identifies the specific cause of the anomaly for each abnormal traffic data, which is helpful for the subsequent targeted processing and blocking strategy design. By marking the data blacklist according to the abnormal cause data, identifying potential threats according to the abnormal cause data, marking the corresponding data as blacklist data, and marking the abnormal data, the blacklist marking helps to monitor the abnormal data in real time and discover potential threats in time. By designing an abnormal data blocking strategy according to the blacklist marked abnormal data, and designing a corresponding blocking strategy according to the characteristics of the blacklist data, it is ensured that the potential threat is responded to in a timely and accurate manner, and the blocking strategy can be adaptively adjusted according to the real-time traffic and threat intelligence, and the flexibility of data security defense is improved. The abnormal data blocking strategy is transmitted to the terminal to perform data security maintenance optimization. The designed abnormal data blocking strategy is transmitted to the terminal in real time to ensure the timeliness of the blocking operation. The terminal performs data security maintenance to improve the system's performance and reliability in overall data security maintenance.

[0182] As an example of the present invention, refer to Figure 6 As shown, Figure 1 Detailed implementation steps of step S5 in the flowchart, in this example, step S5 includes:

[0183] Step S51: Analyze the data content properties of the abnormal traffic isolation data to generate content property data;

[0184] In the embodiment of the present invention, the data content property analysis is performed on the abnormal traffic isolation data, and the abnormal traffic isolation data is deeply analyzed to extract the data packet information therein. Taking HTTP traffic as an example, the system parses the HTTP request, extracts key information such as URL, request method and body content, and uses content parsing technology to split the URL into different parts, such as protocol, host name, path, etc. At the same time, the request method is classified, such as GET, POST, etc., and the HTTP body content is parsed layer by layer to identify the parameters, file upload information, etc. Then, by sniffing malicious code, the content in the data packet is scanned using an antivirus engine. By sniffing malicious code, the content in the data packet is scanned using an antivirus engine. For example, the system detects whether the HTTP request contains malicious SQL injection statements or abnormal file upload operations. Finally, the behavior detection technology is applied to analyze the content behavior in the data packet through means such as deep learning models to determine whether there are abnormal access patterns, requests with too high a frequency, or other behaviors that do not conform to normal behavior patterns. The content property analysis generates content property data, which provides data support for subsequent abnormal data blocking strategies.

[0185] Step S52: Detecting the cause of data anomaly on the traffic isolation data according to the content property data to obtain anomaly cause data;

[0186] In an embodiment of the present invention, the traffic isolation data is detected for data anomaly reasons based on the content nature data, and the content nature in the traffic isolation data is comprehensively analyzed. Taking HTTP traffic as an example, the system checks key information such as URL, request method, and main content in the content nature data. For the URL, the system detects whether it contains abnormal characters, illegal paths or patterns. An in-depth inspection is performed on the main content to find out whether there are abnormal parameter passing methods, illegal characters or patterns. The feature engineering method is also used to extract key features in the content nature data, such as URL length, request method distribution, keywords in the main content, etc., and these features are counted and analyzed. The system can discover the patterns and laws of the abnormal reasons. Finally, the abnormal reason data is generated to identify the specific reasons for the abnormality in the traffic isolation data, which provides a basis for the subsequent data blacklist annotation and the subsequent formulation of an effective abnormal data blocking strategy.

[0187] Step S53: marking the data blacklist according to the abnormal reason data, and generating blacklist marked abnormal data;

[0188] In the embodiment of the present invention, data blacklist annotation is performed according to the abnormal cause data. First, blacklist rules are established through detailed information in the abnormal cause data, such as the detected attack mode, the IP address of the abnormal request, abnormal parameters, etc. For example, if the abnormal cause data shows that a certain IP address frequently sends requests with SQL injection characteristics, the system will put the IP address into the blacklist. A real-time updated blacklist mechanism is adopted to ensure the timeliness and accuracy of blacklist data by regularly updating information such as malicious IP addresses and attack modes, and this is achieved by means such as subscribing to professional threat intelligence sources and implementing a proprietary threat intelligence collection system. When annotating the data blacklist, the system takes into account flexibility and configurability at the same time, allowing administrators to adjust the blacklist annotation rules according to specific circumstances. By providing a management interface or configuration file, the administrator can define specific abnormal behavior patterns, IP address ranges and other information, and add them to the blacklist, and the annotated part of the abnormal traffic data is output as blacklist annotated abnormal data. The data contains traffic information that matches the blacklist rules, which is helpful for further analysis, blocking and security maintenance optimization. Through a flexible blacklist annotation mechanism, the system can respond to changing threats in a timely manner and improve data security.

[0189] Step S54: designing an abnormal data blocking strategy based on the abnormal data marked in the blacklist;

[0190] In an embodiment of the present invention, an abnormal data blocking strategy is designed based on the abnormal data marked by the blacklist, and a spatial path analysis is performed on the abnormal data marked by the blacklist, including the source, target, network path, etc. of the abnormal request. For example, when it is detected that a certain IP has repeatedly attempted to access the path information of the system sensitive files in a short period of time, the path characteristics and timing characteristics of the spatial path data are analyzed, and key path characteristics such as path length, key nodes visited, etc. are extracted. Considering the time series information of the abnormal request, such as the time interval and frequency of the request, an automated abnormal blocking script is written by associating and combining the path characteristics and timing characteristics. For example, when it is detected that a certain IP address has repeatedly attempted to access the sensitive path in a short period of time, and the path contains specific key nodes, the blocking strategy is automatically triggered, and the IP is included in the firewall blacklist. Comprehensively considering the spatial path, path characteristics and timing characteristics of the abnormal data, a refined abnormal blocking strategy is provided for the system, which helps to more effectively deal with potential threats.

[0191] Step S55: Transmit the abnormal data blocking strategy to the terminal to perform data security maintenance optimization.

[0192] In the embodiment of the present invention, the generated abnormal data blocking strategy is transmitted to the firewall device of the network terminal, etc. When the abnormal data blocking strategy reaches the terminal, the firewall device will automatically update its configuration and block the network traffic according to the rules defined in the strategy. For example, if the strategy requires prohibiting access from a specific IP address, the firewall will add corresponding rules to intercept traffic from the IP address, thereby achieving real-time blocking of potential data threats, improving the response speed of the entire system to abnormal behavior data, and effectively protecting the security of the data.

[0193] Preferably, step S54 includes the following steps:

[0194] Step S541: Perform spatial path analysis on the blacklist annotated abnormal data to obtain spatial path data;

[0195] Step S542: performing path feature analysis according to the spatial path data to generate path feature data;

[0196] Step S542: performing time series feature analysis on the path feature data to generate time series feature data;

[0197] Step S543: Write an automated exception blocking script based on the path feature data and the timing feature data to generate an abnormal data blocking strategy.

[0198] The present invention effectively reveals the propagation trajectory of abnormal data in the network by performing spatial path analysis on the abnormal data marked by the blacklist, further identifies the association between abnormal data and the network topology structure, helps the system to deeply understand the propagation behavior of abnormal data, and provides substantial data support for formulating corresponding blocking strategies. According to the spatial path data, path feature analysis can be performed to fully understand the path characteristics of abnormal data in the network, which helps to discover the propagation law and path mode of abnormal data in the network, and provides the system with more accurate and targeted path feature data. The path feature data is analyzed for time series characteristics, and the time series characteristic analysis enables the system to understand the dynamic changes of the propagation path of abnormal data in more detail, provides key information of time series changes for subsequent abnormal data blocking strategies, and helps to take flexible and effective blocking measures in different time periods. Based on the path feature data and the time series feature data, an automated abnormal blocking script is written, and the path feature and the time series feature are combined to design a targeted and efficient blocking script according to the path and time series change law of abnormal data propagation, so as to ensure that the particularity of its propagation path and the regularity of time series changes are fully considered when blocking abnormal data, so as to realize intelligent blocking of abnormal data, improve the response speed of the whole system to abnormal behavior, and effectively protect the security of data.

[0199] In an embodiment of the present invention, a spatial path analysis is performed on the abnormal data marked by the blacklist, the propagation path of the abnormal request is analyzed, the source of the request, the nodes through which the request flows, and other information are determined, and this information is organized into spatial path data. A path feature analysis is performed based on the spatial path data, including the analysis of the length of the path, the correlation of the nodes, the key nodes through which the request passes, etc., so as to generate path feature data. A time series feature analysis is performed on the path feature data, and the time series feature includes information such as the time distribution and frequency change of the abnormal request. An automated abnormal blocking script is written based on the path feature data and the time series feature data. The script is a series of rules or programs. The abnormal request is judged according to the path feature and the time series feature, and the blocking is implemented. For example, the system sets a rule. When the frequency of abnormal requests on the same path exceeds a threshold in a short period of time, a blocking operation is performed. The automated abnormal blocking strategy based on the path and time series features has a high degree of flexibility and adaptability, and can quickly and accurately respond to different types of abnormal behavior data, improve the security of data maintenance, and in addition, because it is an automated script execution, no manual intervention is required, which greatly reduces the burden on the administrator, thereby improving the real-time performance of data security maintenance.

[0200] This specification provides a data security maintenance optimization system based on data analysis, which is used to execute the data security maintenance optimization method based on data analysis as described above. The data security maintenance optimization system based on data analysis includes:

[0201] The data collection module for analysis is used to obtain data analysis permissions; extract the data to be analyzed according to the data analysis permissions and generate the data to be analyzed;

[0202] The data abnormal behavior analysis module is used to perform data splitting processing according to the data to be analyzed, generate split data, perform data abnormal behavior analysis according to the split data, and generate abnormal behavior data;

[0203] The data abnormal flow analysis module is used to analyze the data abnormal flow according to the abnormal behavior data to obtain abnormal flow data;

[0204] The data abnormal traffic isolation module is used to perform abnormal traffic isolation and division processing on abnormal traffic data to generate abnormal traffic isolation data;

[0205] The data security maintenance module is used to design abnormal data blocking strategies based on abnormal traffic isolation data; the abnormal data blocking strategies are transmitted to the terminal to perform data security maintenance optimization.

[0206] The beneficial effect of the present application is that the data security maintenance optimization method based on data analysis of the present invention ensures legal access to data by obtaining data analysis permissions, and realizes the security and compliance of data access and analysis. The data to be analyzed is split and processed to generate split data, thereby reducing the degree of data aggregation, so as to better analyze and identify abnormal behavior data. According to the abnormal behavior data, abnormal traffic analysis is performed on the data to be analyzed, and the traffic characteristics of the data are deeply analyzed, so that the abnormal traffic data is more prominent and easy to capture, and potential abnormal behavior patterns are identified, and the detection of abnormal behavior data is enhanced. The abnormal traffic data is isolated and divided to achieve isolation of potential data risks and effectively slow down the spread of abnormal behavior data. Based on the abnormal traffic isolation data, an abnormal data blocking strategy is designed, and the strategy is transmitted to the terminal to perform data security maintenance optimization, which improves the system data security maintenance response speed, makes the system more real-time and adaptive, and provides strong support for data security. Accurate analysis, identification and isolation of abnormal data and traffic are achieved, providing more effective protection for data security maintenance, improving data security and system stability.

[0207] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0208] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A data security maintenance optimization method based on data analysis, characterized in that: The following steps are involved: Step S1: Obtain data analysis authority; Extract the data to be analyzed according to the data analysis authority and generate the data to be analyzed; Step S2: performing data splitting processing according to the data to be analyzed to generate split data, performing data abnormal behavior analysis according to the split data to generate abnormal behavior data; Wherein, step S2 comprises: Step S21: Perform data application module analysis on the data to be analyzed to obtain application module data; Step S22: performing data flow frequency analysis according to the application module data to generate flow frequency data; Step S23: performing data splitting parameter analysis according to the application module data and the flow frequency data to generate splitting parameters; Step S24: performing data splitting processing on the data to be analyzed according to the splitting parameters to generate split data; Step S25: performing data abnormal behavior analysis based on the split data to generate abnormal behavior data; Wherein, step S25 comprises: Step S251: Obtain data node logs of split data; Step S252: extracting change data from the data node log to obtain change data; Step S253: using the change data to perform change feature data analysis on the split data to generate change feature data; Step S254: Draw a data behavior baseline based on the change feature data to generate behavior baseline data; Step S255: Perform data behavior abnormal deviation detection based on the behavior baseline data to generate a data behavior risk coefficient; Step S256: extracting abnormal behavior data from the split data according to the data behavior risk coefficient to obtain abnormal behavior data; Step S3: performing abnormal traffic analysis on the data to be analyzed according to the abnormal behavior data to obtain abnormal traffic data; Step S4: performing abnormal traffic isolation and division processing on the abnormal traffic data to generate abnormal traffic isolation data; Step S5: designing an abnormal data blocking strategy based on abnormal traffic isolation data; transmitting the abnormal data blocking strategy to the terminal to perform data security maintenance optimization; Wherein, step S5 comprises: Step S51: Analyze the data content properties of the abnormal traffic isolation data to generate content property data; Step S52: Detecting the cause of data anomaly on the traffic isolation data according to the content property data to obtain anomaly cause data; Step S53: marking the data blacklist according to the abnormal reason data, and generating blacklist marked abnormal data; Step S54: designing an abnormal data blocking strategy based on the abnormal data marked in the blacklist; Step S55: Transmitting the abnormal data blocking strategy to the terminal to perform data security maintenance optimization; Wherein, step S54 comprises: Step S541: Perform spatial path analysis on the blacklist annotated abnormal data to obtain spatial path data; Step S542: performing path feature analysis according to the spatial path data to generate path feature data; Step S543: performing time series feature analysis on the path feature data to generate time series feature data; Step S544: Write an automated exception blocking script based on the path feature data and the timing feature data to generate an abnormal data blocking strategy.

2. The data security maintenance optimization method based on data analysis according to claim 1 is characterized in that: Step S1 includes the following steps: Step S11: Obtaining data analysis authority; Step S12: Perform authority analysis according to the data analysis authority to generate authority analysis data; Step S13: performing extraction range analysis of the data to be analyzed according to the authority parsing data to obtain extraction range data; Step S14: collecting data to be analyzed according to the extracted range data to obtain the data to be analyzed.

3. The data security maintenance optimization method based on data analysis according to claim 1 is characterized in that: Step S3 includes the following steps: Step S31: Performing business data traffic flow direction detection according to abnormal behavior data to generate business traffic flow direction data; Step S32: performing business data flow distribution analysis according to the business flow direction data to generate business flow distribution data; Step S33: performing data traffic abnormal pattern analysis according to the service traffic flow direction data and the service traffic distribution data to generate abnormal traffic pattern data; Step S34: performing abnormal traffic analysis on the data to be analyzed according to the abnormal traffic pattern data to obtain abnormal traffic data.

4. The data security maintenance optimization method based on data analysis according to claim 3 is characterized in that: Step S34 includes the following steps: Step S341: Perform historical traffic data analysis on the data to be analyzed to generate historical traffic data; Step S342: analyzing the abnormal traffic degree of the abnormal traffic pattern data according to the historical traffic data to generate traffic abnormality degree data; Step S343: performing abnormal traffic analysis on the abnormal behavior data according to the traffic anomaly degree data to generate abnormal traffic data.

5. The data security maintenance optimization method based on data analysis according to claim 1 is characterized in that: Step S4 includes the following steps: Step S41: extracting the traffic data packet of abnormal traffic data and generating a traffic data packet; Step S42: performing traffic fingerprint identification and analysis according to the traffic data packet to generate traffic fingerprint data; Step S43: performing abnormal traffic label processing according to the traffic fingerprint data to generate abnormal traffic label data; Step S44: performing abnormal traffic isolation and division processing on the abnormal traffic data according to the abnormal traffic label data to generate abnormal traffic isolation data.

6. A data security maintenance optimization system based on data analysis, characterized in that: For executing the data security maintenance optimization method based on data analysis as claimed in claim 1, the data security maintenance optimization system based on data analysis comprises: The data collection module for analysis is used to obtain data analysis permissions; extract the data to be analyzed according to the data analysis permissions and generate the data to be analyzed; The data abnormal behavior analysis module is used to perform data splitting processing according to the data to be analyzed, generate split data, perform data abnormal behavior analysis according to the split data, and generate abnormal behavior data; The data abnormal traffic analysis module is used to perform abnormal traffic analysis on the data to be analyzed based on the abnormal behavior data to obtain abnormal traffic data; The data abnormal traffic isolation module is used to perform abnormal traffic isolation and division processing on abnormal traffic data to generate abnormal traffic isolation data; The data security maintenance module is used to design abnormal data blocking strategies based on abnormal traffic isolation data; the abnormal data blocking strategies are transmitted to the terminal to perform data security maintenance optimization.

Images