A network security testing method based on big data

Abstract

The present invention relates to the field of network security technology, and discloses a network security testing method based on big data, comprising: obtaining target system data, forming analysis data according to the target system data, forming adjustment data according to the analysis data, and adjusting the target system data and the analysis data according to the adjustment data. The network security testing method based on big data determines whether the current operator is the device holder himself, and adjusts the user's use authority accordingly, automatically adjusts the files of the user's system memory disk to keep the user's system memory disk stable, automatically adjusts the downloaded files to the memory disk corresponding to the same type of files, keeps the user's deleted files confidential, improves the user's network security level, prevents the user's files from being maliciously deleted by others, and prevents the user's system from being unstable due to excessive memory usage, and prevents file conflicts from causing system instability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security testing method based on big data. Background Art

[0002] The network security testing method based on big data is a method to identify and evaluate network security risks by collecting, analyzing and mining large-scale network data, including: data collection, data preprocessing, data analysis, anomaly detection, threat intelligence integration, vulnerability scanning, risk assessment, report generation, and continuous improvement. It can help organizations to timely discover and respond to various network security threats and improve network security defense and response capabilities;

[0003] Collect various network data, clean, deduplicate and format the collected data to ensure data quality and consistency, use big data analysis technology to conduct in-depth analysis of pre-processed data, identify abnormal patterns, behaviors and potential security threats, implement anomaly detection algorithms to identify potential network security threats based on the results of data analysis, integrate external threat intelligence sources, compare and analyze with internal data to identify known threats and assess their threat level to network security, use vulnerability scanning tools to scan systems and applications in the network, identify potential security vulnerabilities and weaknesses, comprehensively analyze the collected data and test results, evaluate and rank network security risks, determine which threats are the most serious and urgently need to be dealt with, generate detailed network security test reports, continuously collect new data and analyze them, update security testing methods and strategies, and improve network security defense measures to ensure the continuity and robustness of network security;

[0004] The existing network security testing method based on big data cannot determine whether the current operator is the device holder himself according to the user's input and search habits, and adjust the user's usage permissions accordingly. It cannot automatically adjust the files on the user's system memory disk according to the user's system memory disk usage to keep the user's system memory disk stable. It cannot automatically adjust the downloaded files to the memory disk corresponding to the same type of files according to the storage type of the files in the user's various external memory disks. It cannot keep the user's deleted files confidential according to the user's usage permissions, which reduces the user's network security level and its practicality has certain limitations. Summary of the invention

[0005] The present invention provides a network security testing method based on big data, which is used to promote the solution of the problems mentioned in the background technology.

[0006] The present invention provides the following technical solution: a network security testing method based on big data, comprising:

[0007] Acquire target system data, wherein the target system data includes memory data, software data, and permission data;

[0008] According to the target system data, through the data analysis strategy, the analysis data is formed to analyze and judge whether there are security risks in the network according to the target system data, so as to adjust the target system data and the analysis data to ensure the security of user data;

[0009] According to the analysis data, adjustment data is formed through data adjustment strategy to adjust the target system data and analysis data;

[0010] According to the adjustment data, the target system data and analysis data are adjusted.

[0011] As an optional solution of the network security testing method based on big data described in the present invention, the data analysis strategy includes a permission analysis strategy, which is specifically:

[0012] Obtain all permission levels of the system, including user permission levels and usage permission levels;

[0013] Among them, the user authority level is higher than the usage authority level;

[0014] Obtain all operation permissions of the system, including downloading, moving, and deleting operations;

[0015] Then, the operation permissions corresponding to the user authority level are download operation, move operation, and delete operation;

[0016] Then, the operation permission corresponding to the usage permission level is the download operation;

[0017] Obtain historical operation data of target users;

[0018] Get the current operation data of the target operation user;

[0019] Execute operational comparison strategies;

[0020] If it is determined that the target operation user is the target user, the permission level of the target operation user is determined to be the user permission level;

[0021] If it is determined that the target operation user is not the target user, the permission level of the target operation user is determined to be the use permission level.

[0022] As an optional solution of the network security testing method based on big data described in the present invention, the operation comparison strategy specifically includes:

[0023] Acquire historical operation data of the target user, wherein the historical operation data includes the historical text input duration, input times and confirmation methods of the web page, wherein the confirmation methods include a first confirmation method and a second confirmation method;

[0024] Get the target user's historical text input word count;

[0025] Calculate the average text input time of the target user, which is (the sum of the historical text input time under the input times / the input times) / (the sum of the historical text input words under the input times / the input times);

[0026] Obtain the current operation data of the target operation user, including the current text input duration and confirmation method;

[0027] Get the current number of words input by the target operation user;

[0028] Calculate the average text input time of the target operation user, the average text input time of the target operation user = current text input time / current text input word count;

[0029] The average text input time of the target operation user ≥ the average text input time of the target user × (1-25%), and the average text input time of the target operation user ≤ the average text input time of the target user × (1+25%), which is set as the first judgment condition;

[0030] The confirmation method of the target operation user = the confirmation method of the target user is set as the second determination condition;

[0031] If the target operating user meets the first determination condition and the second determination condition, then the target operating user is determined to be the target user;

[0032] If the target operating user meets the first determination condition but does not meet the second determination condition, it is determined that the target operating user is not the target user;

[0033] If the target operating user does not satisfy the first determination condition but satisfies the second determination condition, it is determined that the target operating user is not the target user.

[0034] As an optional solution of the network security testing method based on big data described in the present invention, the data analysis strategy includes a memory analysis strategy, which is specifically:

[0035] Obtain memory data of the target memory disk, the memory data including memory capacity and storage files, the memory capacity including used memory capacity and total memory capacity;

[0036] Get the memory threshold;

[0037] If the used memory amount of the target memory disk is less than the memory amount threshold, it is determined that the target memory disk usage rate meets the requirement;

[0038] If the used memory of the target memory disk is ≥ the memory threshold, it is determined that the target memory disk usage does not meet the requirement;

[0039] Get all the memory disks in the system, and define the other memory disks except the target memory disk as the adjusted memory disks;

[0040] Obtain the determination result of the target operation user;

[0041] If the target operation user is the target user, obtaining the real-time operation of the target operation user, wherein the real-time operation includes file downloading, file moving, and file deletion;

[0042] If the real-time operation of the target operation user is file downloading, the file allocation strategy of the data adjustment strategy is executed;

[0043] If the real-time operation of the target operation user is file movement, the memory adjustment policy of the data adjustment policy is executed;

[0044] If the real-time operation of the target operation user is file deletion, the file is directly deleted to the recycle bin and is defined as a deleted file;

[0045] Implement user deletion policy;

[0046] If the target operation user is not the target user, obtaining the real-time operation of the target operation user, wherein the real-time operation includes file downloading, file moving, and file deletion;

[0047] If the real-time operation of the target operation user is file downloading, the file allocation strategy of the data adjustment strategy is executed;

[0048] If the target user's real-time operation is to move a file, the file move permission will be locked, and all files cannot be moved automatically or manually.

[0049] If the real-time operation of the target operation user is file deletion, the deletion backup strategy of the data adjustment strategy is executed.

[0050] As an optional solution of the network security testing method based on big data described in the present invention, the user deletion strategy is specifically:

[0051] Get the deletion time threshold;

[0052] Get the time point when the deleted file is deleted and moved to the recycle bin, and set it as the deletion start time point;

[0053] If the target operation user has a file recovery operation within the deletion time threshold, all historical storage locations and storage time points of the deleted file are obtained;

[0054] Calculate the interval duration, interval duration = deletion start time point - storage time point;

[0055] Sort each storage time point from small to large according to the value of the interval duration, and set the storage time point corresponding to the interval duration with the smallest value as the target recovery time point;

[0056] Extract the historical storage location corresponding to the target recovery time point, then the historical storage location is the file storage location where the deleted file is restored, and the deleted file is restored;

[0057] If the target user does not perform file recovery operations within the deletion time threshold, the Recycle Bin will automatically shred and delete the deleted files after the shredding time point is reached. At this time, the deleted files cannot be recovered. The shredding time point = the deletion start time point + the deletion time threshold.

[0058] As an optional solution of the network security testing method based on big data described in the present invention, the data adjustment strategy includes a memory adjustment strategy, which is specifically:

[0059] Get each file in the adjusted memory disk and set it as the target determination file;

[0060] For each adjustment memory disk, extract the file type of each target judgment file in the adjustment memory disk and form a type set, recorded as A1, ..., An;

[0061] For each adjusted memory disk, the number of target judgment files corresponding to each file type is obtained, which is defined as the judgment number;

[0062] For each type set of the adjusted memory disk, sort them from large to small according to the value of the judgment quantity corresponding to each file type, and organize them into a new type set;

[0063] For each memory disk to be adjusted, the file type corresponding to the judgment quantity with the largest value in the type set is extracted and determined as the target type, and the target type is the file storage type of the memory disk to be adjusted;

[0064] Get all removable files in the target memory disk;

[0065] Get the file type for each removable file and set it as a removable type;

[0066] Compare each removable type with the file storage type corresponding to each adjusted memory disk;

[0067] If there is an adjustment memory disk corresponding to the file storage type consistent with the removable type data, the adjustment memory disk is set as the target removable memory disk, and the removable file corresponding to the removable type is set as the target removable file;

[0068] Move the target mobile file from the target memory disk to the target mobile memory disk;

[0069] If there is no adjustment memory disk corresponding to the file storage type consistent with the movable type data, the used memory amount and the total memory amount of all adjustment memory disks are obtained;

[0070] Calculate the available memory of each adjusted memory disk, available memory = total memory - used memory;

[0071] Sort all the adjustment memory disks from large to small according to the values ​​of the available memory, and set the adjustment memory disk corresponding to the available memory with the largest value as the target mobile memory disk;

[0072] Move the target mobile file from the target memory disk to the target mobile memory disk.

[0073] As an optional solution of the network security testing method based on big data described in the present invention, the data adjustment strategy includes a file allocation strategy, which is specifically:

[0074] Obtaining all sub-file information contained in the target download file, defining the target sub-file information as the target sub-file information, wherein the target sub-file information includes the sub-file name and the sub-file quantity;

[0075] Get all files in the target memory disk and all adjusted memory disks and set them as target search files;

[0076] Extract the file names and file numbers of all target search files to form a file comparison set;

[0077] Compare the sub-file names and sub-file quantities with the file names and file quantities in the file comparison set one by one;

[0078] If there are sub-files with the same file name and the same number of sub-files, it is determined that there is a file conflict;

[0079] If there is no file name with the same data in the sub-file name and there is a file number with the same data in the sub-file number, it is determined that the files do not conflict;

[0080] If the sub-file names have the same file name and the sub-file numbers do not have the same file number, then it is determined that the files do not conflict;

[0081] If there is no file name with the same data in the sub-file name and no file number with the same data in the sub-file number, it is determined that the files do not conflict;

[0082] If it is determined that the files do not conflict, the download adjustment strategy is executed;

[0083] If it is determined that there is a file conflict, the file name that is the same as the sub-file name data and the file number that is the same as the sub-file number data are obtained and are set as the target name and target number respectively;

[0084] Delete the target search file corresponding to the target name under the target quantity and execute the download adjustment strategy.

[0085] As an optional solution of the network security testing method based on big data described in the present invention, the download adjustment strategy is specifically:

[0086] Obtaining file data of a target download file, wherein the file data includes file memory capacity and file type;

[0087] Extract the file type of the target download file and set it as the download type;

[0088] Compare the download type with the file storage type corresponding to each adjusted memory disk;

[0089] The adjusted memory disk corresponding to the file storage type consistent with the download type data is set as the target download memory disk;

[0090] Get the used memory and total memory of the target download memory disk;

[0091] If the file memory size of the target download file is less than the total memory size of the target download memory disk - the used memory size, the target download file will be automatically downloaded to the target download memory disk;

[0092] If the file memory size of the target download file is ≥ the total memory size of the target download memory disk - the used memory size, then the used memory size and total memory size of all adjusted memory disks are obtained;

[0093] Calculate the available memory of each adjusted memory disk, available memory = total memory - used memory;

[0094] Sort all the adjustment memory disks from large to small according to the values ​​of the available memory, and set the adjustment memory disk corresponding to the available memory with the largest value as the target download memory disk;

[0095] Automatically download the target download file to the target download memory disk.

[0096] As an optional solution of the network security testing method based on big data described in the present invention, the data adjustment strategy includes a deletion backup strategy, which is specifically:

[0097] The recycle bin is provided with a hidden backup folder;

[0098] Move the file from the current storage location to the hidden backup folder and set the file as a backup deletion file;

[0099] If the target operation user is the target user, the Recycle Bin displays the hidden backup folder;

[0100] Get the time point when the backup deleted file is deleted and moved to the hidden backup folder, and set it as the backup start time point;

[0101] The backup start time is used as the starting time to determine the target operation user's authority level in real time.

[0102] The time point at which the target operation user's permission level is first determined as the user permission level after the initial determination time is defined as the first time point;

[0103] At the first point in time, a hidden backup folder is popped up to the target operating user, and the target user is prompted that there is a file deleted by others, and the target user is asked whether to restore the file;

[0104] If the target user chooses to restore the file, all historical storage locations and storage time points of the deleted file are obtained;

[0105] Calculate the target duration, target duration = first time point - storage time point;

[0106] Sort each storage time point from small to large according to the target duration value, and set the storage time point corresponding to the target duration with the smallest value as the backup recovery time point;

[0107] Extract the historical storage location corresponding to the backup recovery time point, then the historical storage location is the file storage location where the backup deleted file is restored, and restore the backup deleted file;

[0108] If the target user chooses not to restore the file, the backup deleted file is moved from the hidden backup folder to the Recycle Bin. At this time, the backup deleted file is converted to a deleted file, and the user deletion policy is executed;

[0109] If the target operation user is not the target user, the Recycle Bin does not display the hidden backup folder.

[0110] The present invention has the following beneficial effects:

[0111] 1. This network security testing method based on big data obtains the input and search habits of the current operator, compares them with the historical habits of the device holder, determines whether the current operator is the device holder himself, and adjusts the user's usage permissions accordingly. If the current operator is the device holder himself, when the operator deletes the file, there is no need to protect the deleted file. If the current operator is not the device holder himself, when the operator deletes the file, it is necessary to protect the deleted file, thereby improving the user's network security level and preventing the user's files from being maliciously deleted by others, thereby causing greater losses.

[0112] 2. The network security testing method based on big data obtains the memory amount of the user's system memory disk to determine whether the memory of the system memory disk is overused. If the memory of the system memory disk is overused, the removable files in the system memory disk are moved to an external memory disk with the same file type. If the memory of the external memory disk is insufficient, the files are moved to an external memory disk with sufficient memory, thereby improving the user's network security level and preventing the user's system from becoming unstable due to excessive memory use, thereby causing greater losses.

[0113] 3. The network security testing method based on big data obtains the file information of the operator's downloaded file and determines whether there are identical files in each memory disk. If there are files with the same data as the downloaded file in each memory disk, the files with the same data will be deleted, and the downloaded file will be stored in an external memory disk with the same file type. If the memory of the external memory disk is insufficient, it will be moved to an external memory disk with sufficient memory. If there are no files with the same data as the downloaded file in each memory disk, the downloaded file will be directly stored in a suitable external memory disk, thereby improving the user's network security level and preventing file conflicts from causing system instability, thereby causing greater losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0114] Figure 1 This is a block diagram of the network security testing method based on big data of the present invention. DETAILED DESCRIPTION

[0115] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0116] Embodiment 1, a network security testing method based on big data, see Figure 1 ,include:

[0117] Acquire target system data, wherein the target system data includes memory data, software data, and permission data;

[0118] According to the target system data, through the data analysis strategy, the analysis data is formed to analyze and judge whether there are security risks in the network according to the target system data, so as to adjust the target system data and the analysis data to ensure the security of user data;

[0119] According to the analysis data, adjustment data is formed through data adjustment strategy to adjust the target system data and analysis data;

[0120] According to the adjustment data, the target system data and analysis data are adjusted.

[0121] Through the above method, according to the user's input and search habits, it is determined whether the current operator is the device holder himself, and the user's usage permissions are adjusted accordingly. According to the usage of the user's system memory disk, the files of the user's system memory disk are automatically adjusted to keep the user's system memory disk stable. According to the storage type of the files in the user's additional memory disk, the downloaded files are automatically adjusted to the memory disk corresponding to the same type of files. According to the user's usage permissions, the user's deleted files are kept confidential, which improves the user's network security level, prevents the user's files from being maliciously deleted by others, and prevents the user's system from being unstable due to excessive memory usage. At the same time, it prevents file conflicts from causing system instability, thereby causing greater losses.

[0122] Embodiment 2: This embodiment is an improvement made on the basis of embodiment 1. The network security testing method based on big data, the data analysis strategy, including the authority analysis strategy, is specifically:

[0123] Obtain all the system's permission levels, including user permission levels and usage permission levels. The user permission level is the permission level that the machine owner can operate, and the usage permission level is the permission level that non-machine owner can operate;

[0124] Among them, the user authority level is higher than the usage authority level;

[0125] Obtain all operation permissions of the system, including downloading, moving, and deleting operations;

[0126] Then, the operation permissions corresponding to the user authority level are download operation, move operation, and delete operation;

[0127] Then, the operation permission corresponding to the usage permission level is the download operation;

[0128] Obtain the historical operation data of the target user, which is all the operation data of the owner himself, so as to analyze the usage habits of the owner himself, thereby determining whether the current operating user is the owner himself, and determining the corresponding authority level;

[0129] Obtaining the current operation data of the target operating user, where the current operation data of the target operating user is the operation data of the current operating user, and comparing it with the historical operation data of the target user to determine whether the current operating user is the device owner, and determine the corresponding authority level;

[0130] Execute operational comparison strategies;

[0131] If it is determined that the target operation user is the target user, the permission level of the target operation user is determined to be the user permission level;

[0132] If it is determined that the target operation user is not the target user, the permission level of the target operation user is determined to be the use permission level.

[0133] The operation comparison strategy specifically includes:

[0134] Acquire historical operation data of the target user, the historical operation data including the historical text input duration, input times and confirmation method of the web page, the confirmation method including the first confirmation method and the second confirmation method, the historical operation data of the target user is all the operation data of the machine owner himself, so as to analyze the usage habits of the machine owner himself, thereby judging whether the current operating user is the machine owner himself, and determining the corresponding authority level, the confirmation method is the method in which the target user enters the search web page after entering text in the web page search box, the first confirmation method is to enter the search web page by pressing Enter, and the second confirmation method is to enter the search web page by clicking the search button;

[0135] Get the target user's historical text input word count;

[0136] Calculate the average text input time of the target user, which is (the sum of the historical text input time under the input times / the input times) / (the sum of the historical text input words under the input times / the input times);

[0137] Obtaining the current operation data of the target operating user, including the current text input duration and confirmation method, wherein the current operation data of the target operating user is the operation data of the current operating user, and by comparing with the historical operation data of the target user, determining whether the current operating user is the device owner, and determining the corresponding authority level;

[0138] Get the current number of words input by the target operation user;

[0139] Calculate the average text input time of the target operation user, the average text input time of the target operation user = current text input time / current text input word count;

[0140] The average text input time of the target operation user ≥ the average text input time of the target user × (1-25%), and the average text input time of the target operation user ≤ the average text input time of the target user × (1+25%), which is set as the first judgment condition;

[0141] The confirmation method of the target operation user = the confirmation method of the target user is set as the second determination condition;

[0142] If the target operating user meets the first determination condition and the second determination condition, then the target operating user is determined to be the target user;

[0143] If the target operating user meets the first determination condition but does not meet the second determination condition, it is determined that the target operating user is not the target user;

[0144] If the target operating user does not satisfy the first determination condition but satisfies the second determination condition, it is determined that the target operating user is not the target user.

[0145] This solution takes into account that network security is not only related to the operator's permissions, but also to the system's memory usage.

[0146] This embodiment also provides that the data analysis strategy includes a memory analysis strategy, specifically:

[0147] Obtain memory data of a target memory disk, wherein the memory data includes memory capacity and storage files, wherein the memory capacity includes used memory capacity and total memory capacity, and the target memory disk is a system disk;

[0148] Obtain a memory threshold, where the memory threshold is the maximum memory capacity of the target memory disk that can store files when the system is running stably;

[0149] If the used memory amount of the target memory disk is less than the memory amount threshold, it is determined that the target memory disk usage rate meets the requirement;

[0150] If the used memory of the target memory disk is ≥ the memory threshold, it is determined that the target memory disk usage does not meet the requirement;

[0151] Get all the memory disks in the system, and define the other memory disks except the target memory disk as the adjusted memory disks;

[0152] Obtain the determination result of the target operation user;

[0153] If the target operation user is the target user, obtaining the real-time operation of the target operation user, wherein the real-time operation includes file downloading, file moving, and file deletion;

[0154] If the real-time operation of the target operation user is file downloading, the file allocation strategy of the data adjustment strategy is executed;

[0155] If the real-time operation of the target operation user is file movement, the memory adjustment policy of the data adjustment policy is executed;

[0156] If the real-time operation of the target operation user is file deletion, the file is directly deleted to the recycle bin and is defined as a deleted file;

[0157] Implement user deletion policy;

[0158] If the target operation user is not the target user, obtaining the real-time operation of the target operation user, wherein the real-time operation includes file downloading, file moving, and file deletion;

[0159] If the real-time operation of the target operation user is file downloading, the file allocation strategy of the data adjustment strategy is executed;

[0160] If the target user's real-time operation is to move a file, the file move permission will be locked, and all files cannot be moved automatically or manually.

[0161] If the real-time operation of the target operation user is file deletion, the deletion backup strategy of the data adjustment strategy is executed.

[0162] The user deletion policy is specifically as follows:

[0163] Get the deletion time threshold, which is the length of time it takes for a deleted file to be completely deleted after it is moved to the recycle bin. For example, if the deletion time threshold is 15 days and the deleted file is moved to the recycle bin on January 10, the deleted file is completely deleted from the recycle bin on January 25.

[0164] Get the time point when the deleted file is deleted and moved to the recycle bin, and set it as the deletion start time point;

[0165] If the target operation user has a file recovery operation within the deletion time threshold, all historical storage locations and storage time points of the deleted file are obtained;

[0166] Calculate the interval duration, interval duration = deletion start time point - storage time point;

[0167] Sort each storage time point from small to large according to the value of the interval duration, and set the storage time point corresponding to the interval duration with the smallest value as the target recovery time point;

[0168] Extract the historical storage location corresponding to the target recovery time point, then the historical storage location is the file storage location where the deleted file is restored, and the deleted file is restored;

[0169] If the target user does not perform file recovery operations within the deletion time threshold, the Recycle Bin will automatically shred and delete the deleted files after the shredding time point is reached. At this time, the deleted files cannot be recovered. The shredding time point = the deletion start time point + the deletion time threshold.

[0170] Embodiment 3: This embodiment is an improvement made on the basis of Embodiment 2. In this embodiment, the data adjustment strategy includes a memory adjustment strategy, which is specifically:

[0171] Get each file in the adjusted memory disk and set it as the target determination file;

[0172] For each adjustment memory disk, extract the file type of each target judgment file in the adjustment memory disk and form a type set, recorded as A1, ..., An;

[0173] For each adjusted memory disk, the number of target judgment files corresponding to each file type is obtained, which is defined as the judgment number;

[0174] For each type set of the adjusted memory disk, sort them from large to small according to the value of the judgment quantity corresponding to each file type, and organize them into a new type set;

[0175] For each memory disk to be adjusted, the file type corresponding to the judgment quantity with the largest value in the type set is extracted and determined as the target type, and the target type is the file storage type of the memory disk to be adjusted;

[0176] Obtain all removable files in the target memory disk, where the removable files are non-system-native files, i.e., files whose deletion will not affect the system;

[0177] Get the file type for each removable file and set it as a removable type;

[0178] Compare each removable type with the file storage type corresponding to each adjusted memory disk;

[0179] If there is an adjustment memory disk corresponding to the file storage type consistent with the removable type data, the adjustment memory disk is set as the target removable memory disk, and the removable file corresponding to the removable type is set as the target removable file;

[0180] Move the target mobile file from the target memory disk to the target mobile memory disk;

[0181] If there is no adjustment memory disk corresponding to the file storage type consistent with the movable type data, the used memory amount and the total memory amount of all adjustment memory disks are obtained;

[0182] Calculate the available memory of each adjusted memory disk, available memory = total memory - used memory;

[0183] Sort all the adjustment memory disks from large to small according to the values ​​of the available memory, and set the adjustment memory disk corresponding to the available memory with the largest value as the target mobile memory disk;

[0184] Move the target mobile file from the target memory disk to the target mobile memory disk.

[0185] This embodiment also provides that the data adjustment strategy includes a file allocation strategy, specifically:

[0186] Obtaining all sub-file information contained in the target download file, defining the target sub-file information as the target sub-file information, wherein the target sub-file information includes the sub-file name and the sub-file quantity;

[0187] Get all files in the target memory disk and all adjusted memory disks and set them as target search files;

[0188] Extract the file names and file numbers of all target search files to form a file comparison set;

[0189] Compare the sub-file names and sub-file quantities with the file names and file quantities in the file comparison set one by one;

[0190] If there are sub-files with the same file name and the same number of sub-files, it is determined that there is a file conflict;

[0191] If there is no file name with the same data in the sub-file name and there is a file number with the same data in the sub-file number, it is determined that the files do not conflict;

[0192] If the sub-file names have the same file name and the sub-file numbers do not have the same file number, then it is determined that the files do not conflict;

[0193] If there is no file name with the same data in the sub-file name and no file number with the same data in the sub-file number, it is determined that the files do not conflict;

[0194] If it is determined that the files do not conflict, the download adjustment strategy is executed;

[0195] If it is determined that there is a file conflict, the file name that is the same as the sub-file name data and the file number that is the same as the sub-file number data are obtained and are set as the target name and target number respectively;

[0196] Delete the target search file corresponding to the target name under the target quantity and execute the download adjustment strategy.

[0197] The download adjustment strategy is specifically:

[0198] Obtaining file data of a target download file, wherein the file data includes file memory capacity and file type;

[0199] Extract the file type of the target download file and set it as the download type;

[0200] Compare the download type with the file storage type corresponding to each adjusted memory disk;

[0201] The adjusted memory disk corresponding to the file storage type consistent with the download type data is set as the target download memory disk;

[0202] Get the used memory and total memory of the target download memory disk;

[0203] If the file memory size of the target download file is less than the total memory size of the target download memory disk - the used memory size, the target download file will be automatically downloaded to the target download memory disk;

[0204] If the file memory size of the target download file is ≥ the total memory size of the target download memory disk - the used memory size, then the used memory size and total memory size of all adjusted memory disks are obtained;

[0205] Calculate the available memory of each adjusted memory disk, available memory = total memory - used memory;

[0206] Sort all the adjustment memory disks from large to small according to the values ​​of the available memory, and set the adjustment memory disk corresponding to the available memory with the largest value as the target download memory disk;

[0207] Automatically download the target download file to the target download memory disk.

[0208] This embodiment also provides that the data adjustment strategy includes a deletion backup strategy, specifically:

[0209] The recycle bin is provided with a hidden backup folder;

[0210] Move the file from the current storage location to the hidden backup folder and set the file as a backup deletion file;

[0211] If the target operation user is the target user, the Recycle Bin will display a hidden backup folder. After the target user uses the computer, the hidden backup folder in the Recycle Bin will automatically pop up and prompt the target user that there is a file deleted by others, asking the target user whether to restore the file. If the target user chooses to restore the file, the file will be automatically restored to the storage location when the file was deleted. If the target user chooses not to restore the file, the file will be automatically moved from the hidden backup folder to the Recycle Bin. If the target user still does not restore the file within the deletion time threshold, the file will be automatically shredded and deleted after the shredding time point is reached;

[0212] Get the time point when the backup deleted file is deleted and moved to the hidden backup folder, and set it as the backup start time point;

[0213] The backup start time is used as the starting time to determine the target operation user's authority level in real time.

[0214] The time point at which the target operation user's permission level is first determined as the user permission level after the initial determination time is defined as the first time point;

[0215] At the first point in time, a hidden backup folder is popped up to the target operating user, and the target user is prompted that there is a file deleted by others, and the target user is asked whether to restore the file;

[0216] If the target user chooses to restore the file, all historical storage locations and storage time points of the deleted file are obtained;

[0217] Calculate the target duration, target duration = first time point - storage time point;

[0218] Sort each storage time point from small to large according to the target duration value, and set the storage time point corresponding to the target duration with the smallest value as the backup recovery time point;

[0219] Extract the historical storage location corresponding to the backup recovery time point, then the historical storage location is the file storage location where the backup deleted file is restored, and restore the backup deleted file;

[0220] If the target user chooses not to restore the file, the backup deleted file is moved from the hidden backup folder to the Recycle Bin. At this time, the backup deleted file is converted to a deleted file, and the user deletion policy is executed;

[0221] If the target operation user is not the target user, the Recycle Bin will not display the hidden backup folder. At this time, the target operation user cannot completely delete the file through the Recycle Bin, which can protect the file.

[0222] This embodiment determines whether the current operator is the device holder himself based on the user's input and search habits, and adjusts the user's usage permissions accordingly. It automatically adjusts the files on the user's system memory disk based on the usage of the user's system memory disk to keep the user's system memory disk stable. It automatically adjusts the downloaded files to the memory disk corresponding to the same type of files based on the storage type of the files in the user's additional memory disks. It keeps the user's deleted files confidential based on the user's usage permissions, thereby improving the user's network security level, preventing the user's files from being maliciously deleted by others, and preventing the user's system from being unstable due to excessive memory usage. It also prevents file conflicts from causing system instability, thereby causing greater losses.

Claims

1. A network security testing method based on big data, characterized by: include: Acquire target system data, wherein the target system data includes memory data, software data, and permission data; According to the target system data, through the data analysis strategy, the analysis data is formed to analyze and judge whether there are security risks in the network according to the target system data, so as to adjust the target system data and the analysis data to ensure the security of user data; According to the analysis data, adjustment data is formed through data adjustment strategy to adjust the target system data and analysis data; Adjust the target system data and analysis data according to the adjustment data; The data analysis strategy, including the authority analysis strategy, is specifically: Obtain all permission levels of the system, including user permission levels and usage permission levels; Among them, the user authority level is higher than the usage authority level; Obtain all operation permissions of the system, including downloading, moving, and deleting operations; Then, the operation permissions corresponding to the user authority level are download operation, move operation, and delete operation; Then, the operation permission corresponding to the usage permission level is the download operation; Obtain historical operation data of target users; Get the current operation data of the target operation user; Execute operational comparison strategies; If it is determined that the target operation user is the target user, the permission level of the target operation user is determined to be the user permission level; If it is determined that the target operation user is not the target user, the permission level of the target operation user is determined to be the use permission level; The data analysis strategy, including the memory analysis strategy, is specifically: Obtain memory data of the target memory disk, the memory data including memory capacity and storage files, the memory capacity including used memory capacity and total memory capacity; Get the memory threshold; If the used memory amount of the target memory disk is less than the memory amount threshold, it is determined that the target memory disk usage rate meets the requirement; If the used memory of the target memory disk is ≥ the memory threshold, it is determined that the target memory disk usage does not meet the requirement; Get all the memory disks in the system, and define the other memory disks except the target memory disk as the adjusted memory disks; Obtain the determination result of the target operation user; If the target operation user is the target user, obtaining the real-time operation of the target operation user, wherein the real-time operation includes file downloading, file moving, and file deletion; If the real-time operation of the target operation user is file downloading, the file allocation strategy of the data adjustment strategy is executed; If the real-time operation of the target operation user is file movement, the memory adjustment policy of the data adjustment policy is executed; If the real-time operation of the target operation user is file deletion, the file is directly deleted to the recycle bin and is defined as a deleted file; Implement user deletion policy; If the target operation user is not the target user, obtaining the real-time operation of the target operation user, wherein the real-time operation includes file downloading, file moving, and file deletion; If the real-time operation of the target operation user is file downloading, the file allocation strategy of the data adjustment strategy is executed; If the target user's real-time operation is to move a file, the file move permission will be locked, and all files cannot be moved automatically or manually. If the real-time operation of the target operation user is file deletion, the deletion backup strategy of the data adjustment strategy is executed; The data adjustment strategy, including the memory adjustment strategy, is specifically: Get each file in the adjusted memory disk and set it as the target determination file; For each adjustment memory disk, extract the file type of each target judgment file in the adjustment memory disk and form a type set, recorded as A1, ..., An; For each adjusted memory disk, the number of target judgment files corresponding to each file type is obtained, which is defined as the judgment number; For each type set of the adjusted memory disk, sort them from large to small according to the value of the judgment quantity corresponding to each file type, and organize them into a new type set; For each memory disk to be adjusted, the file type corresponding to the judgment quantity with the largest value in the type set is extracted and determined as the target type, and the target type is the file storage type of the memory disk to be adjusted; Get all removable files in the target memory disk; Get the file type for each removable file and set it as a removable type; Compare each removable type with the file storage type corresponding to each adjusted memory disk; If there is an adjustment memory disk corresponding to the file storage type consistent with the removable type data, the adjustment memory disk is set as the target removable memory disk, and the removable file corresponding to the removable type is set as the target removable file; Move the target mobile file from the target memory disk to the target mobile memory disk; If there is no adjustment memory disk corresponding to the file storage type consistent with the movable type data, the used memory amount and the total memory amount of all adjustment memory disks are obtained; Calculate the available memory of each adjusted memory disk, available memory = total memory - used memory; Sort all the adjustment memory disks from large to small according to the values ​​of the available memory, and set the adjustment memory disk corresponding to the available memory with the largest value as the target mobile memory disk; Move the target mobile file from the target memory disk to the target mobile memory disk.

2. The network security testing method based on big data according to claim 1 is characterized in that: The operation comparison strategy specifically includes: Acquire historical operation data of the target user, wherein the historical operation data includes the historical text input duration, input times and confirmation methods of the web page, wherein the confirmation methods include a first confirmation method and a second confirmation method; Get the target user's historical text input word count; Calculate the average text input time of the target user, which is (the sum of the historical text input time under the input times / the input times) / (the sum of the historical text input words under the input times / the input times); Obtain the current operation data of the target operation user, including the current text input duration and confirmation method; Get the current number of words input by the target operation user; Calculate the average text input time of the target operation user, the average text input time of the target operation user = current text input time / current text input word count; The average text input time of the target operation user ≥ the average text input time of the target user × (1-25%), and the average text input time of the target operation user ≤ the average text input time of the target user × (1+25%), which is set as the first judgment condition; The confirmation method of the target operation user = the confirmation method of the target user is set as the second determination condition; If the target operating user meets the first determination condition and the second determination condition, then the target operating user is determined to be the target user; If the target operating user meets the first determination condition but does not meet the second determination condition, it is determined that the target operating user is not the target user; If the target operating user does not satisfy the first determination condition but satisfies the second determination condition, it is determined that the target operating user is not the target user.

3. The network security testing method based on big data according to claim 1 is characterized in that: The user deletion policy is specifically: Get the deletion time threshold; Get the time point when the deleted file is deleted and moved to the recycle bin, and set it as the deletion start time point; If the target operation user has a file recovery operation within the deletion time threshold, all historical storage locations and storage time points of the deleted file are obtained; Calculate the interval duration, interval duration = deletion start time point - storage time point; Sort each storage time point from small to large according to the value of the interval duration, and set the storage time point corresponding to the interval duration with the smallest value as the target recovery time point; Extract the historical storage location corresponding to the target recovery time point, then the historical storage location is the file storage location where the deleted file is restored, and the deleted file is restored; If the target user does not perform file recovery operations within the deletion time threshold, the Recycle Bin will automatically shred and delete the deleted files after the shredding time point is reached. At this time, the deleted files cannot be recovered. The shredding time point = the deletion start time point + the deletion time threshold.

4. The network security testing method based on big data according to claim 1 is characterized in that: The data adjustment strategy includes a file allocation strategy, specifically: Obtaining all sub-file information contained in the target download file, defining the target sub-file information as the target sub-file information, wherein the target sub-file information includes the sub-file name and the sub-file quantity; Get all files in the target memory disk and all adjusted memory disks and set them as target search files; Extract the file names and file numbers of all target search files to form a file comparison set; Compare the sub-file names and sub-file quantities with the file names and file quantities in the file comparison set one by one; If there are sub-files with the same file name and the same number of sub-files, it is determined that there is a file conflict; If there is no file name with the same data in the sub-file name and there is a file number with the same data in the sub-file number, it is determined that the files do not conflict; If the sub-file names have the same file name and the sub-file numbers do not have the same file number, then it is determined that the files do not conflict; If there is no file name with the same data in the sub-file name and no file number with the same data in the sub-file number, it is determined that the files do not conflict; If it is determined that the files do not conflict, the download adjustment strategy is executed; If it is determined that there is a file conflict, the file name that is the same as the sub-file name data and the file number that is the same as the sub-file number data are obtained and are set as the target name and target number respectively; Delete the target search file corresponding to the target name under the target quantity and execute the download adjustment strategy.

5. The network security testing method based on big data according to claim 4 is characterized in that: The download adjustment strategy is specifically: Obtaining file data of a target download file, wherein the file data includes file memory capacity and file type; Extract the file type of the target download file and set it as the download type; Compare the download type with the file storage type corresponding to each adjusted memory disk; The adjusted memory disk corresponding to the file storage type consistent with the download type data is set as the target download memory disk; Get the used memory and total memory of the target download memory disk; If the file memory size of the target download file is less than the total memory size of the target download memory disk - the used memory size, the target download file will be automatically downloaded to the target download memory disk; If the file memory size of the target download file is ≥ the total memory size of the target download memory disk - the used memory size, then obtain the used memory size and total memory size of all adjusted memory disks; Calculate the available memory of each adjusted memory disk, available memory = total memory - used memory; Sort all the adjustment memory disks from large to small according to the values ​​of the available memory, and set the adjustment memory disk corresponding to the available memory with the largest value as the target download memory disk; Automatically download the target download file to the target download memory disk.

6. The network security testing method based on big data according to claim 1 is characterized in that: The data adjustment strategy includes a deletion backup strategy, specifically: The recycle bin is provided with a hidden backup folder; Move the file from the current storage location to the hidden backup folder and set the file as a backup deletion file; If the target operation user is the target user, the Recycle Bin displays the hidden backup folder; Get the time point when the backup deleted file is deleted and moved to the hidden backup folder, and set it as the backup start time point; The backup start time is used as the starting time to determine the target operation user's authority level in real time. The time point at which the target operation user's permission level is first determined as the user permission level after the initial determination time is defined as the first time point; At the first point in time, a hidden backup folder is popped up to the target operating user, and the target user is prompted that there is a file deleted by others, and the target user is asked whether to restore the file; If the target user chooses to restore the file, all historical storage locations and storage time points of the deleted file are obtained; Calculate the target duration, target duration = first time point - storage time point; Sort each storage time point from small to large according to the target duration value, and set the storage time point corresponding to the target duration with the smallest value as the backup recovery time point; Extract the historical storage location corresponding to the backup recovery time point, then the historical storage location is the file storage location where the backup deleted file is restored, and restore the backup deleted file; If the target user chooses not to restore the file, the backup deleted file is moved from the hidden backup folder to the Recycle Bin. At this time, the backup deleted file is converted to a deleted file, and the user deletion policy is executed; If the target operation user is not the target user, the Recycle Bin does not display the hidden backup folder.

Images