Internet data security protection method and system based on intelligent algorithm

Abstract

The invention discloses an internet data security protection method and system based on an intelligent algorithm, and relates to the technical field of security protection. During system operation, user behavior data are collected in real time through log recording, a sensor and an API interface, the real-time operation behavior of a user is monitored, the interaction mode and transaction behavior of the user on a platform are analyzed, and the security of the user is improved. Calculating and acquiring a user behavior safety coefficient Yhxw, a data transmission safety coefficient Sjcs and a risk protection response coefficient Fxfh, identifying potential fraudulent behaviors, performing dynamic risk assessment by combining user historical behaviors, a transaction amount, a geographic position and data of payment equipment, performing threshold comparison to obtain an assessment scheme, and during login and transaction, combining multiple identity verification means to obtain a risk protection result; according to the method, user identity verification is carried out, security of login behaviors is dynamically monitored, network traffic and platform logs are analyzed, abnormal access and malicious requests or DDOS attacks are detected in real time, and abnormal behaviors or attacks are automatically identified and prevented.

Description

Technical Field

[0001] The present invention relates to the field of security protection technology, and in particular to an Internet data security protection method and system based on an intelligent algorithm. Background Art

[0002] In the current digital age, Internet data security protection has become a core issue in the field of technology. Especially in the field of e-commerce platforms, with the surge in transaction volume and user data, ensuring data security and privacy has become an urgent task. Traditional security protection methods often rely on rule settings and fixed protection strategies, but these methods have limited ability to respond to rapidly changing forms of network attacks and emerging threats. Traditional methods usually rely on manual settings and manual rule updates, and cannot identify unknown attack patterns or respond to complex attack chains in a timely manner. In addition, rule engines often have performance bottlenecks when processing massive amounts of data, resulting in delayed responses to attack information or even missed reports.

[0003] The defects of existing data security protection measures stem from their adherence to static rules and preset protection frameworks. This approach shows obvious lag in the face of complex network attacks. For example, in e-commerce platforms, once attackers use new attack methods or covert strategies, traditional systems are often unable to detect and respond effectively in a timely manner. This protection lag not only increases the risk of data leakage, but may also cause serious financial losses and damage to brand reputation, bringing immeasurable negative impacts to platform operations. The introduction of intelligent algorithms can effectively avoid these problems and significantly reduce the probability of security incidents through real-time risk assessment and dynamic defense strategies. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides an Internet data security protection method and system based on an intelligent algorithm, which solves the problems mentioned in the background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: an Internet data security protection system based on intelligent algorithms, including a data acquisition module, a data encryption protection module, a fraud detection risk assessment module, a dynamic identity authentication module, an intrusion protection module and a security feedback automatic response module; The data collection module is used to collect user behavior data in real time through log records, sensors and API interfaces, including login information, browsing history, transaction records and IP addresses, and analyze their interaction patterns on the platform by monitoring the real-time operation behavior of users, including browsing time, frequent operations and transaction amounts; The data encryption protection module is used to encrypt sensitive data, including user account information, payment passwords and transaction records, using symmetric encryption AES or asymmetric encryption RSA, TLS / SSL protocol to ensure encryption during data transmission, combined with quantum encryption technology, to provide a higher level of security during data transmission; The fraud detection risk assessment module is used to use machine learning models: random forest, support vector machine SVM or deep learning model to analyze the user's transaction behavior and payment method, calculate and obtain: user behavior safety factor Yhxw, data transmission safety factor Sjcs and risk protection response factor Fxfh, identify potential fraudulent behaviors, including stolen credit card, false transactions and money laundering, and conduct dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location, and payment device data, and obtain an assessment plan after threshold comparison; The dynamic identity authentication module is used to combine multiple identity authentication methods, including SMS verification code, fingerprint recognition and dynamic password, to authenticate users during login and transaction, and use intelligent algorithms to analyze the user's device ID, login IP and geographic location to dynamically monitor the security of login behavior; The intrusion protection module is used to analyze network traffic and platform logs through deep learning models, including convolutional neural networks (CNN) and long short-term memory networks (LSTM), detect abnormal access and malicious requests or DDOS attacks in real time, and automatically identify and prevent abnormal behaviors or attacks according to preset security rules; The security feedback automatic response module is used to monitor the security events of the platform in real time, promptly feedback abnormal or attack information, and automatically respond to security threats by triggering preset emergency measures including restricting account login, freezing funds and encrypting transmission.

[0006] Preferably, the data collection module includes a user behavior log collection unit, a user behavior analysis unit and a real-time behavior monitoring unit; The user behavior log collection unit is used to record the user's login information, browsing history and transaction records through logs, and automatically generate user behavior data through the platform system log, including the user's login time, login frequency, browsing path, access duration and transaction amount. All logs are recorded by timestamp to facilitate subsequent data analysis and behavior pattern mining to obtain: login frequency P lf 、Abnormal trading volume P et , access time distribution P at and login location changesP lg ; The user behavior analysis unit is used to analyze the user's interaction mode through the collected behavior log data using statistics and machine learning algorithms. The analysis content includes the changing trends of browsing time, frequent operations and transaction amounts, and identifies the user's behavior patterns and deviations through algorithms to help determine potential abnormal behaviors. Through the network traffic monitoring system and network security equipment IDS and IPS, it monitors the data transmission rate and delay, detects the integrity of data packets and identifies potential network attacks, monitors the data encryption algorithm and key strength, and obtains: data encryption strength P ec , transmission rate P tr 、Network delay P nd , Packet Integrity P dp , intrusion detection response time P it , activation rate of protective measures P fa , Risk warning accuracy P ra and recovery time P rt ; The real-time behavior monitoring unit is used to obtain the user's interactive behavior data through sensors, API interfaces and real-time monitoring systems, and dynamically display it to the platform security management system. During the user interaction process, the user's frequent logins and transactions in abnormal time periods are monitored in real time to support the platform's immediate response.

[0007] Preferably, the data encryption protection module includes a data transmission encryption unit and an access control unit; The data transmission encryption unit is used to select a suitable encryption algorithm according to the sensitivity of the data, including the symmetric encryption algorithm AES and the asymmetric encryption algorithm RSA, and select the encryption strength according to the security requirements. During the platform data transmission process, the TLS / SSL protocol is used to encrypt the data for transmission, combined with quantum encryption technology, to further enhance the data's anti-attack capability during the transmission process; The access control unit is responsible for the decryption operation of encrypted data and performs access control on different users according to authority management to ensure that only authorized users can access and decrypt sensitive data. The system combines role authority with identity authentication mechanism for management.

[0008] Preferably, the fraud detection risk assessment module includes a transaction behavior analysis unit, a risk assessment prediction unit and a risk threshold determination unit; The transaction behavior analysis unit is used to monitor the user's transaction behavior in real time, and build a user's transaction behavior model based on the transaction amount, transaction frequency and payment method, and identify abnormal transaction behavior patterns, including frequent large-amount transactions and transactions in abnormal time periods; The risk assessment prediction unit is used to predict potential risks through historical transaction data and user behavior data based on machine learning algorithms such as random forest, SVM and deep learning models, and to obtain user behavior safety coefficient Yhxw, data transmission safety coefficient Sjcs, risk protection response coefficient Fxfh and comprehensive safety index Zhaq in combination with the algorithm; The risk threshold judgment unit is used to judge whether the current user behavior or transaction reaches the risk warning line by comparing with the preset risk threshold, and execute corresponding security protection measures according to the evaluation result.

[0009] Preferably, the user behavior safety factor Yhxw is calculated by the following formula: ; In the formula, Represents the login frequency P lf 、Abnormal trading volume P et , access time distribution P at and login location changesP lg The weighting coefficient, P it (t), P et (t), P at (t) and P lg (t) represents the login frequency, abnormal transaction volume, access time distribution and login geographical location changes, respectively, with the change of time t, λ represents the time decay factor, t represents the time variable, representing the time point when the behavior occurs; The data transmission safety factor Sjcs is calculated by the following formula: ; In the formula, Represents the data encryption strength P ec , transmission rate P tr 、Network delay P nd and packet integrity P dp The weighting coefficient, P ec (t) represents the data encryption strength, which changes over time, P tr (t) represents the transmission rate, P nd (t) represents the network delay, which changes with time, P dp (t) represents the packet integrity, which is processed using a logarithmic function to simulate the impact of packet damage or tampering, and γ represents the time attenuation factor of network transmission impact; The risk protection response coefficient Fxfh is calculated by the following formula: ; In the formula, They represent the intrusion detection response time P it , activation rate of protective measures P fa , Risk warning accuracy P ra and recovery time P rt The weighting coefficient, Pit (t) represents the intrusion detection response time, which varies with time, P fa (t) represents the activation rate of the protection measure, which varies with time, P ra (t) represents the accuracy of the risk warning, which varies with time, P rt (t) represents the recovery time, and σ represents the time decay factor of the risk protection response; The comprehensive security index Zhaq is obtained by calculating through the following formula: ; In the formula, represents the weight coefficients of the user behavior security factor Yhxw, the data transmission security factor Sjcs, and the risk protection response factor Fxfh, ζ represents the time decay factor of the comprehensive security index, representing the change trend of the security state over time, represents the time integral term, which is used to simulate the process of the security of the system gradually decaying over time.

[0010] Preferably, the risk threshold comparison includes: Zhaq < K indicates that the security of the platform is unqualified and there are potential security threats, including data leakage, fraud, or malicious attacks. An emergency security response is required. At this security level, all transmitted sensitive data, including user identity information, payment passwords, and transaction records, is encrypted using advanced encryption technology. Once abnormal transactions or login behaviors are detected, the system risk control strategy is immediately triggered, including security measures such as freezing accounts, restricting transactions, and requiring password changes. Through traffic monitoring and log analysis, real-time responses are made to abnormal access and interception is carried out to prevent attackers from invading the platform through vulnerabilities; Zhaq ≥ K indicates that the security protection of the platform has reached a qualified level, but it still needs to be optimized and consolidated regularly to prevent new security risks and attack methods from emerging. The user transaction behaviors, login habits, and network access patterns are monitored in real time. Combining with deep learning models, the platform's ability to identify potential fraud behaviors such as abnormal transactions and illegal logins is continuously improved, and the phenomena of false positives and false negatives are reduced.

[0011] Preferably, the dynamic authentication module includes a multi-factor authentication unit, a user device monitoring unit, and a dynamic behavior analysis unit; The multi-factor authentication unit is used for user login and transactions, and conducts identity authentication by combining multi-factor authentication means such as SMS verification codes, fingerprint recognition, and dynamic passwords to ensure the legality of the user's identity; The user device monitoring unit is used to analyze the user's login behavior pattern by monitoring the user's device ID, IP address, and geographical location information to determine whether there is abnormal login behavior and trigger further identity authentication; The dynamic behavior analysis unit is used to analyze the dynamic changes of the user's behavior in combination with the user's historical login and transaction behaviors, detect in real time whether the user has abnormal behavior, and provide real-time security feedback for abnormal behavior.

[0012] Preferably, the intrusion protection module includes a network traffic monitoring unit, an abnormal request identification unit and an attack defense response unit; The network traffic monitoring unit is used to monitor the network traffic of the platform in real time, and analyze network requests in combination with the convolutional neural network (CNN) deep learning model to identify potential malicious requests or attack behaviors; The abnormal request identification unit identifies abnormal network request patterns, including frequent IP requests and abnormal access time periods, through a machine learning algorithm to identify potential intrusion behaviors; The attack defense response unit is used to respond to malicious attack behaviors through automated rules, and immediately initiate defense measures when an attack is detected, including IP blocking and traffic speed limiting.

[0013] Preferably, the safety feedback automatic response module includes a safety event monitoring unit and an automatic response unit; The security event monitoring unit is used to monitor the security events of the platform in real time and detect potential security threats, including data leakage and account anomalies. The monitoring content includes user behavior, system logs and transaction data; The automated response unit is used to automatically initiate corresponding protective measures according to the type and severity of the security incident, including freezing accounts, restricting logins, and encrypting transmissions, and to provide real-time feedback to platform security managers on the implementation status and effects of emergency response measures.

[0014] The Internet data security protection method based on intelligent algorithm includes the following steps: Step 1: Collect user behavior data in real time through log records, sensors and API interfaces, including login information, browsing history, transaction records and IP addresses. By monitoring users' real-time operation behaviors, analyze their interaction patterns on the platform, including browsing time, frequent operations and transaction amounts; Step 2: Encrypt sensitive data, including user account information, payment passwords, and transaction records, using symmetric encryption AES or asymmetric encryption RSA, TLS / SSL protocol to ensure encryption during data transmission, combined with quantum encryption technology to provide a higher level of security during data transmission; Step 3: Use machine learning models such as random forest, support vector machine (SVM) or deep learning models to analyze the user's transaction behavior and payment method, and calculate and obtain: user behavior security factor Yhxw, data transmission security factor Sjcs and risk protection response factor Fxfh, identify potential fraudulent behaviors, including card theft, false transactions and money laundering, and conduct dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location and payment device data, and obtain the assessment plan after threshold comparison; Step 4: When logging in and making transactions, we use a combination of multiple authentication methods, including SMS verification code, fingerprint recognition and dynamic passwords to authenticate users, and use intelligent algorithms to analyze the user's device ID, login IP and geographic location to dynamically monitor the security of login behavior; Step 5: Through deep learning models, including convolutional neural networks (CNN) and long short-term memory networks (LSTM), we analyze network traffic and platform logs, detect abnormal access and malicious requests or DDOS attacks in real time, and automatically identify and block abnormal behaviors or attacks based on preset security rules; Step 6: Monitor the platform's security incidents in real time, promptly provide feedback on abnormalities or attack information, and automatically respond to security threats by triggering preset emergency measures including restricting account logins, freezing funds, and encrypting transmissions.

[0015] The present invention provides an Internet data security protection method and system based on an intelligent algorithm, which has the following beneficial effects: (1) When the system is running, it collects user behavior data in real time through log records, sensors and API interfaces. By monitoring the user's real-time operation behavior, it analyzes their interaction patterns and transaction behaviors on the platform, calculates and obtains: user behavior security factor Yhxw, data transmission security factor Sjcs and risk protection response factor Fxfh, identifies potential fraudulent behavior, and conducts dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location, and payment device data. After comparing the thresholds, it obtains the assessment plan. When logging in and trading, it combines multiple identity authentication methods to perform user identity authentication, dynamically monitors the security of login behavior, analyzes network traffic and platform logs, detects abnormal access and malicious requests or DDOS attacks in real time, and automatically identifies and prevents abnormal behavior or attacks.

[0016] (2) Through the close cooperation of six modules, the overall effect of data security protection has been significantly improved. These modules include data collection and analysis, real-time threat detection, risk assessment and early warning, abnormal behavior identification, automatic emergency response and data encryption protection. The system can monitor and dynamically analyze user behavior, network traffic and data interaction in real time to identify potential security threats. This approach makes data protection not limited to traditional static defense, but improves security and system response speed through intelligent analysis and automated protection methods, and ensures the privacy of user data and the operational security of the platform.

[0017] (3) The improvements brought about by this intelligent data protection system are reflected in many aspects. First, the system can identify potential threats more accurately, reduce false alarms and missed alarms, and improve the accuracy of security protection. Second, through the automated emergency response mechanism, it can respond in the early stages of an attack and quickly reduce losses. In addition, the introduction of intelligent algorithms makes the data protection system more adaptable, able to continuously learn and optimize protection strategies to ensure that it can cope with the evolving security challenges in the future. In general, compared with current technical means, this solution based on intelligent algorithms has significantly improved data security, response efficiency, and system adaptability, providing more reliable security protection for Internet platforms. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a block diagram of the Internet data security protection system based on intelligent algorithm of the present invention; Figure 2 The figure is a schematic diagram of the steps of the Internet data security protection method based on intelligent algorithm of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example

[0020] The present invention provides an Internet data security protection system based on intelligent algorithms, please refer to Figure 1 , including data collection module, data encryption protection module, fraud detection risk assessment module, dynamic identity authentication module, intrusion protection module and security feedback automatic response module; The data collection module is used to collect user behavior data in real time through log records, sensors and API interfaces, including login information, browsing history, transaction records and IP addresses, and analyze their interaction patterns on the platform by monitoring the real-time operation behavior of users, including browsing time, frequent operations and transaction amounts; The data encryption protection module is used to encrypt sensitive data, including user account information, payment passwords and transaction records, using symmetric encryption AES or asymmetric encryption RSA, TLS / SSL protocol to ensure encryption during data transmission, combined with quantum encryption technology, to provide a higher level of security during data transmission; The fraud detection risk assessment module is used to use machine learning models: random forest, support vector machine SVM or deep learning model to analyze the user's transaction behavior and payment method, calculate and obtain: user behavior safety factor Yhxw, data transmission safety factor Sjcs and risk protection response factor Fxfh, identify potential fraudulent behaviors, including stolen credit card, false transactions and money laundering, and conduct dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location, and payment device data, and obtain an assessment plan after threshold comparison; The dynamic identity authentication module is used to combine multiple identity authentication methods, including SMS verification code, fingerprint recognition and dynamic password, to authenticate users during login and transaction, and use intelligent algorithms to analyze the user's device ID, login IP and geographic location to dynamically monitor the security of login behavior; The intrusion protection module is used to analyze network traffic and platform logs through deep learning models, including convolutional neural networks (CNN) and long short-term memory networks (LSTM), detect abnormal access and malicious requests or DDOS attacks in real time, and automatically identify and prevent abnormal behaviors or attacks according to preset security rules; The security feedback automatic response module is used to monitor the security events of the platform in real time, promptly feedback abnormal or attack information, and automatically respond to security threats by triggering preset emergency measures including restricting account login, freezing funds and encrypting transmission.

[0021] In this embodiment, user behavior data is collected in real time through log records, sensors and API interfaces. By monitoring the user's real-time operation behavior, the user's interaction mode and transaction behavior on the platform are analyzed, and the following are calculated: user behavior safety factor Yhxw, data transmission safety factor Sjcs and risk protection response factor Fxfh, to identify potential fraudulent behaviors, including credit card fraud, false transactions and money laundering. Dynamic risk assessment is performed based on the user's historical behavior, transaction amount, geographic location, and payment device data. The assessment plan is obtained after threshold comparison. When logging in and trading, user identity authentication is performed in combination with multiple identity authentication methods. The user's device ID, login IP and geographic location are analyzed using intelligent algorithms to dynamically monitor the security of login behavior. The network traffic and platform logs are analyzed through deep learning models to detect abnormal access and malicious requests or DDOS attacks in real time, and abnormal behavior or attacks are automatically identified and blocked. Example

[0022] This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically: the data collection module includes a user behavior log collection unit, a user behavior analysis unit and a real-time behavior monitoring unit; The user behavior log collection unit is used to record the user's login information, browsing history and transaction records through logs, and automatically generate user behavior data through the platform system log, including the user's login time, login frequency, browsing path, access duration and transaction amount. All logs are recorded by timestamp to facilitate subsequent data analysis and behavior pattern mining to obtain: login frequency P lf 、Abnormal trading volume P et , access time distribution P at and login location changesP lg ; The user behavior analysis unit is used to analyze the user's interaction mode through the collected behavior log data using statistics and machine learning algorithms. The analysis content includes the changing trends of browsing time, frequent operations and transaction amounts, and identifies the user's behavior patterns and deviations through algorithms to help determine potential abnormal behaviors. Through the network traffic monitoring system and network security equipment IDS and IPS, it monitors the data transmission rate and delay, detects the integrity of data packets and identifies potential network attacks, monitors the data encryption algorithm and key strength, and obtains: data encryption strength P ec , transmission rate P tr 、Network delay P nd , Packet Integrity P dp , intrusion detection response time P it , activation rate of protective measures P fa , Risk warning accuracy P ra and recovery time P rt ; The real-time behavior monitoring unit is used to obtain the user's interactive behavior data through sensors, API interfaces and real-time monitoring systems, and dynamically display it to the platform security management system. During the user interaction process, the user's frequent logins and transactions in abnormal time periods are monitored in real time to support the platform's immediate response.

[0023] The data encryption protection module includes a data transmission encryption unit and an access control unit; The data transmission encryption unit is used to select a suitable encryption algorithm according to the sensitivity of the data, including the symmetric encryption algorithm AES and the asymmetric encryption algorithm RSA, and select the encryption strength according to the security requirements. During the platform data transmission process, the TLS / SSL protocol is used to encrypt the data for transmission, combined with quantum encryption technology, to further enhance the data's anti-attack capability during the transmission process; The access control unit is responsible for the decryption operation of encrypted data and performs access control on different users according to authority management to ensure that only authorized users can access and decrypt sensitive data. The system combines role authority with identity authentication mechanism for management.

[0024] The fraud detection risk assessment module includes a transaction behavior analysis unit, a risk assessment prediction unit and a risk threshold judgment unit; The transaction behavior analysis unit is used to monitor the user's transaction behavior in real time, and build a user's transaction behavior model based on the transaction amount, transaction frequency and payment method, and identify abnormal transaction behavior patterns, including frequent large-amount transactions and transactions in abnormal time periods; The risk assessment prediction unit is used to predict potential risks through historical transaction data and user behavior data based on machine learning algorithms such as random forest, SVM and deep learning models, and to obtain user behavior safety coefficient Yhxw, data transmission safety coefficient Sjcs, risk protection response coefficient Fxfh and comprehensive safety index Zhaq in combination with the algorithm; The risk threshold judgment unit is used to judge whether the current user behavior or transaction reaches the risk warning line by comparing with the preset risk threshold, and execute corresponding security protection measures according to the evaluation result.

[0025] In this embodiment, the modules of the system work together to bring significant beneficial effects. First, by recording and analyzing the user's behavior log in real time through the data acquisition module, the platform can deeply explore the user's interaction mode and deviation, identify potential abnormal behavior, and warn of possible security risks in advance. Secondly, the data encryption protection module provides multi-level protection measures to ensure that the platform can adopt appropriate encryption algorithms such as AES, RSA and quantum encryption technology during data transmission, which greatly enhances the anti-attack ability of data during transmission. In addition, the access control unit ensures that only authorized users can access sensitive data through precise permission management and identity authentication mechanisms, effectively preventing data leakage and unauthorized access, and further enhancing the strictness of data protection. Finally, the fraud detection and risk assessment module predicts potential security risks based on machine learning algorithms and historical data through transaction behavior analysis, risk assessment prediction and risk threshold judgment, and conducts security assessment of user behavior through a comprehensive security index. The system can detect abnormal transaction behavior in a timely manner and automatically take corresponding protective measures based on the risk assessment results, thereby improving the accuracy and automation level of protection. Example

[0026] This embodiment is explained in Example 1, please refer to Figure 1 Specifically: the user behavior safety factor Yhxw is calculated by the following formula: ; In the formula, Represents the login frequency P lf 、Abnormal trading volume P et , access time distribution P at and login location changesP lg The weighting coefficient, P it (t), P et (t), P at (t) and P lg (t) represents the login frequency, abnormal transaction volume, access time distribution and login geographical location changes, respectively, with the change of time t, λ represents the time decay factor, t represents the time variable, representing the time point when the behavior occurs; The data transmission safety factor Sjcs is calculated by the following formula: ; In the formula, Represents the data encryption strength P ec , transmission rate P tr 、Network delay P nd and packet integrity P dp The weighting coefficient, P ec (t) represents the data encryption strength, which changes over time, P tr (t) represents the transmission rate, P nd(t) represents network latency, which varies over time, and P dp (t) represents packet integrity, which is processed using a logarithmic function to simulate the impact of packet corruption or tampering, and γ represents the time decay factor of network transmission impact; The risk protection response coefficient Fxfh is obtained by calculating through the following formula: ; In the formula, respectively represent the intrusion detection response time P it , the protection measure activation rate P fa , the risk warning accuracy P ra and the recovery time P rt weighting coefficients of, and P it (t) represents the intrusion detection response time, which varies over time, and P fa (t) represents the protection measure activation rate, which varies over time, and P ra (t) represents the risk warning accuracy, which varies over time, and P rt (t) represents the recovery time, and σ represents the time decay factor of risk protection response; The comprehensive security index Zhaq is obtained by calculating through the following formula: ; In the formula, represents the weight coefficients of the user behavior security factor Yhxw, the data transmission security factor Sjcs and the risk protection response coefficient Fxfh, ζ represents the time decay factor of the comprehensive security index, representing the change trend of the security state over time, represents the time integral term, which is used to simulate the process of the system's security gradually decaying over time.

[0027] The risk threshold comparison includes: Zhaq < K indicates that the security of the platform is unqualified and there are potential security threats, including data leakage, fraud or malicious attacks, and emergency security responses are required. At this security level, all transmitted sensitive data, including user identity information, payment passwords and transaction records, are encrypted using advanced encryption technologies. Once abnormal transactions or login behaviors are detected, the system risk control strategy is immediately triggered, including security measures such as freezing accounts, restricting transactions and requiring password changes. Through traffic monitoring and log analysis, real-time responses are made to abnormal access and interception is carried out to prevent attackers from invading the platform through vulnerabilities; Zhaq ≥ K indicates that the security protection of the platform has reached a qualified level, but it still needs to be optimized and consolidated regularly to prevent new security risks and attack methods from emerging. The user transaction behaviors, login habits and network access patterns are monitored in real time, and combined with deep learning models, the platform's ability to identify potential fraud behaviors such as abnormal transactions and illegal logins is continuously improved, and the false alarm and missed alarm phenomena are reduced.

[0028] In this embodiment, through the coordinated operation of the above modules, the system significantly improves the security protection capability of the platform and brings many beneficial effects. First, the user behavior security factor Yhxw combines parameters such as login frequency, abnormal transaction volume, access time distribution, and login geographical location changes to dynamically evaluate the risk of user behavior through weighted calculation. Over time, the system can identify potential abnormal behaviors, warn of possible security risks in advance, and take corresponding security measures based on these data, such as monitoring and restricting suspicious logins or transactions, reducing the occurrence of data leakage and fraud. Secondly, the data transmission security factor Sjcs comprehensively evaluates the security of data during transmission by weighted calculation of factors such as data encryption strength, transmission rate, network delay, and data packet integrity. The system uses encryption algorithms, network traffic monitoring, and data packet integrity verification to ensure that data is protected from attacks during transmission. Through the introduction of time decay factors, the system can evaluate the security changes of the network environment in real time and respond in a timely manner, thereby improving the anti-attack capability and reliability of data transmission. Example

[0029] This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically: the dynamic identity authentication module includes a multi-factor identity authentication unit, a user device monitoring unit and a dynamic behavior analysis unit; The multi-factor authentication unit is used for user login and transaction, combining SMS verification code, fingerprint recognition and dynamic password multi-factor authentication means to perform identity authentication to ensure the legitimacy of the user's identity; The user device monitoring unit is used to analyze the user's login behavior pattern by monitoring the user's device ID, IP address and geographic location information to determine whether there is abnormal login behavior and trigger further identity verification; The dynamic behavior analysis unit is used to analyze the dynamic changes of the user's behavior in combination with the user's historical login and transaction behaviors, detect in real time whether the user has abnormal behavior, and provide real-time security feedback for abnormal behavior.

[0030] The intrusion protection module includes a network traffic monitoring unit, an abnormal request identification unit and an attack defense response unit; The network traffic monitoring unit is used to monitor the network traffic of the platform in real time, and analyze network requests in combination with the convolutional neural network (CNN) deep learning model to identify potential malicious requests or attack behaviors; The abnormal request identification unit identifies abnormal network request patterns, including frequent IP requests and abnormal access time periods, through a machine learning algorithm to identify potential intrusion behaviors; The attack defense response unit is used to respond to malicious attack behaviors through automated rules, and immediately initiate defense measures when an attack is detected, including IP blocking and traffic speed limiting.

[0031] The intrusion protection module includes a network traffic monitoring unit, an abnormal request identification unit and an attack defense response unit; The network traffic monitoring unit is used to monitor the network traffic of the platform in real time, and analyze network requests in combination with the convolutional neural network (CNN) deep learning model to identify potential malicious requests or attack behaviors; The abnormal request identification unit identifies abnormal network request patterns, including frequent IP requests and abnormal access time periods, through a machine learning algorithm to identify potential intrusion behaviors; The attack defense response unit is used to respond to malicious attack behaviors through automated rules, and immediately initiate defense measures when an attack is detected, including IP blocking and traffic speed limiting.

[0032] In this embodiment, through the collaborative work of the dynamic identity authentication module and the intrusion protection module, the system realizes multiple verifications of user identities and in-depth monitoring and intelligent response to the platform network traffic, thereby effectively improving the security of the platform. First, the dynamic identity authentication module effectively prevents illegal login and fraud through multi-factor identity authentication, device monitoring and dynamic behavior analysis. The dynamic behavior analysis unit combines the user's historical login and transaction behavior, monitors the changes in its behavior in real time, identifies potential abnormal behavior and promptly feedbacks security warnings, thereby enhancing the ability to prevent account theft. Secondly, the intrusion protection module enhances the platform's defense against network attacks through network traffic monitoring, abnormal request identification and attack defense response. The abnormal request identification unit can identify abnormal network request patterns such as frequent IP requests and abnormal access time periods through machine learning algorithms, timely discover potential intrusion behaviors, and initiate responses through automated rules. When the attack behavior is identified, the attack defense response unit quickly executes defense measures, such as IP blocking, traffic speed limiting, etc., to prevent the spread of attacks to the greatest extent and ensure the security of the platform. Example

[0033] For Internet data security protection methods based on intelligent algorithms, please refer to Figure 2 , specifically: including the following steps: Step 1: Collect user behavior data in real time through log records, sensors and API interfaces, including login information, browsing history, transaction records and IP addresses. By monitoring users' real-time operation behaviors, analyze their interaction patterns on the platform, including browsing time, frequent operations and transaction amounts; Step 2: Encrypt sensitive data, including user account information, payment passwords, and transaction records, using symmetric encryption AES or asymmetric encryption RSA, TLS / SSL protocol to ensure encryption during data transmission, combined with quantum encryption technology to provide a higher level of security during data transmission; Step 3: Use machine learning models such as random forest, support vector machine (SVM) or deep learning models to analyze the user's transaction behavior and payment method, and calculate and obtain: user behavior security factor Yhxw, data transmission security factor Sjcs and risk protection response factor Fxfh, identify potential fraudulent behaviors, including card theft, false transactions and money laundering, and conduct dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location and payment device data, and obtain the assessment plan after threshold comparison; Step 4: When logging in and making transactions, we use a combination of multiple authentication methods, including SMS verification code, fingerprint recognition and dynamic passwords to authenticate users, and use intelligent algorithms to analyze the user's device ID, login IP and geographic location to dynamically monitor the security of login behavior; Step 5: Through deep learning models, including convolutional neural networks (CNN) and long short-term memory networks (LSTM), we analyze network traffic and platform logs, detect abnormal access and malicious requests or DDOS attacks in real time, and automatically identify and block abnormal behaviors or attacks based on preset security rules; Step 6: Monitor the platform's security incidents in real time, promptly provide feedback on abnormalities or attack information, and automatically respond to security threats by triggering preset emergency measures including restricting account logins, freezing funds, and encrypting transmissions.

[0034] In this embodiment, through the implementation of the above steps, the platform has achieved remarkable results in improving data security, user behavior monitoring and network protection. First, real-time data collection and encryption processing ensure the integrity and security of user behavior data, and protect sensitive data such as account information, payment passwords and transaction records through multi-layer encryption, avoiding the risk of data leakage. The combination of TLS / SSL protocol and quantum encryption technology further enhances the anti-attack capability during data transmission and provides a higher level of security for user transactions. Secondly, intelligent risk analysis and behavior monitoring realize in-depth analysis of user transaction behavior through machine learning models (such as random forests, SVM and deep learning models), timely identify potential fraud behaviors such as stolen cards, false transactions and money laundering, and help the platform achieve dynamic risk assessment and accurate identification. Through multi-dimensional data input (such as historical behavior, transaction amount, geographic location, payment device), the system can more accurately analyze user behavior patterns, and conduct risk assessment based on threshold comparison, so as to make a timely security response.

[0035] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An Internet data security protection system based on intelligent algorithms, characterized by: It includes data collection module, data encryption protection module, fraud detection risk assessment module, dynamic identity authentication module, intrusion protection module and security feedback automatic response module; The data collection module is used to collect user behavior data in real time through log records, sensors and API interfaces, including login information, browsing history, transaction records and IP addresses, and analyze their interaction patterns on the platform by monitoring the real-time operation behavior of users, including browsing time, frequent operations and transaction amounts; The data encryption protection module is used to encrypt sensitive data, including user account information, payment passwords and transaction records, using symmetric encryption AES or asymmetric encryption RSA, TLS / SSL protocol to ensure encryption during data transmission, combined with quantum encryption technology, to provide a higher level of security during data transmission; The fraud detection risk assessment module is used to use machine learning models: random forest, support vector machine SVM or deep learning model to analyze the user's transaction behavior and payment method, calculate and obtain: user behavior safety factor Yhxw, data transmission safety factor Sjcs and risk protection response factor Fxfh, identify potential fraudulent behaviors, including stolen credit card, false transactions and money laundering, and conduct dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location, and payment device data, and obtain an assessment plan after threshold comparison; The dynamic identity authentication module is used to combine multiple identity authentication methods, including SMS verification code, fingerprint recognition and dynamic password, to authenticate users during login and transaction, and use intelligent algorithms to analyze the user's device ID, login IP and geographic location to dynamically monitor the security of login behavior; The intrusion protection module is used to analyze network traffic and platform logs through deep learning models, including convolutional neural networks (CNN) and long short-term memory networks (LSTM), detect abnormal access and malicious requests or DDOS attacks in real time, and automatically identify and prevent abnormal behaviors or attacks according to preset security rules; The security feedback automatic response module is used to monitor the security events of the platform in real time, promptly feedback abnormal or attack information, and automatically respond to security threats by triggering preset emergency measures including restricting account login, freezing funds and encrypting transmission.

2. The Internet data security protection system based on intelligent algorithm according to claim 1 is characterized by: The data collection module includes a user behavior log collection unit, a user behavior analysis unit and a real-time behavior monitoring unit; The user behavior log collection unit is used to record the user's login information, browsing history and transaction records through logs, and automatically generate user behavior data through the platform system log, including the user's login time, login frequency, browsing path, access duration and transaction amount. All logs are recorded by timestamp to facilitate subsequent data analysis and behavior pattern mining to obtain: login frequency P lf 、Abnormal trading volume P et , access time distribution P at and login location changesP lg ; The user behavior analysis unit is used to analyze the user's interaction mode through the collected behavior log data using statistics and machine learning algorithms. The analysis content includes the changing trends of browsing time, frequent operations and transaction amounts, and identifies the user's behavior patterns and deviations through algorithms to help determine potential abnormal behaviors. Through the network traffic monitoring system and network security equipment IDS and IPS, it monitors the data transmission rate and delay, detects the integrity of data packets and identifies potential network attacks, monitors the data encryption algorithm and key strength, and obtains: data encryption strength P ec , transmission rate P tr 、Network delay P nd , Packet Integrity P dp , intrusion detection response time P it , activation rate of protective measures P fa , Risk warning accuracy P ra and recovery time P rt ; The real-time behavior monitoring unit is used to obtain the user's interactive behavior data through sensors, API interfaces and real-time monitoring systems, and dynamically display it to the platform security management system. During the user interaction process, the user's frequent logins and transactions in abnormal time periods are monitored in real time to support the platform's immediate response.

3. The Internet data security protection system based on intelligent algorithm according to claim 1 is characterized by: The data encryption protection module includes a data transmission encryption unit and an access control unit; The data transmission encryption unit is used to select appropriate encryption algorithms according to the sensitivity of data, including the symmetric encryption algorithm AES and the asymmetric encryption algorithm RSA, and select the encryption strength according to security requirements. During the platform data transmission process, the TLS / SSL protocol is used to encrypt and transmit data, and combined with quantum encryption technology to further enhance the anti-attack ability of data during transmission; The access control unit is responsible for the decryption operation of encrypted data and performs access control on different users according to permission management to ensure that only authorized users can access and decrypt sensitive data. The system is managed by combining role permissions and identity authentication mechanisms.

4. The Internet data security protection system based on intelligent algorithm according to claim 1 is characterized by: The fraud detection risk assessment module includes a transaction behavior analysis unit, a risk assessment prediction unit, and a risk threshold judgment unit; The transaction behavior analysis unit is used to construct a user's transaction behavior model by real-time monitoring the user's transaction behavior, combining transaction amount, transaction frequency, and payment method, and identify abnormal transaction behavior patterns, including frequent large-amount transactions and transactions during abnormal time periods; The risk assessment prediction unit is used to predict potential risks through machine learning algorithms based on random forest, SVM, and deep learning models, and combine the algorithms to obtain the user behavior security coefficient Yhxw, the data transmission security coefficient Sjcs, the risk protection response coefficient Fxfh, and the comprehensive security index Zhaq; The risk threshold judgment unit is used to judge whether the current user behavior or transaction reaches the risk warning line by comparing with the preset risk threshold, and execute corresponding security protection measures according to the evaluation results.

5. The Internet data security protection system based on intelligent algorithm according to claim 4 is characterized by: The user behavior safety factor Yhxw is calculated by the following formula: ; In the formula, Represents the login frequency P lf 、Abnormal trading volume P et , access time distribution P at and login location changesP lg The weighting coefficient, P it (t), P et (t), P at (t) and P lg (t) represents the login frequency, abnormal transaction volume, access time distribution and login geographical location changes, respectively, with the change of time t, λ represents the time decay factor, t represents the time variable, representing the time point when the behavior occurs; The data transmission safety factor Sjcs is calculated by the following formula: ; In the formula, Represents the data encryption strength P ec , transmission rate P tr 、Network delay P nd and packet integrity P dp The weighting coefficient, P ec (t) represents the data encryption strength, which changes over time, P tr (t) represents the transmission rate, P nd (t) represents the network delay, which changes with time, P dp (t) represents the packet integrity, which is processed using a logarithmic function to simulate the impact of packet damage or tampering, and γ represents the time attenuation factor of network transmission impact; The risk protection response coefficient Fxfh is calculated by the following formula: ; In the formula, They represent the intrusion detection response time P it , activation rate of protective measures P fa , Risk warning accuracy P ra and recovery time P rt The weighting coefficient, P it (t) represents the intrusion detection response time, which changes with time, P fa (t) represents the activation rate of protective measures, which changes over time, P ra (t) represents the risk warning accuracy, which changes over time, P rt (t) represents the recovery time, σ represents the time decay factor of the risk protection response; The comprehensive safety index Zhaq is calculated by the following formula: ; In the formula, represents the weight coefficient of user behavior security factor Yhxw, data transmission security factor Sjcs and risk protection response factor Fxfh, ζ represents the time decay factor of the comprehensive security index, and represents the changing trend of security status over time. Represents the time integral term, which is used to simulate the process in which the security of the system gradually decays over time.

6. The Internet data security protection system based on intelligent algorithm according to claim 5 is characterized by: The risk threshold comparison includes: Zhaq < K indicates that the security of the platform is unqualified and there are potential security threats, including data leakage, fraud, or malicious attacks. Emergency security responses are required. At this security level, all transmitted sensitive data, including user identity information, payment passwords, and transaction records, are encrypted using advanced encryption technology. Once abnormal transactions or login behaviors are detected, the system risk control strategy is immediately triggered, including security measures such as freezing accounts, restricting transactions, and requiring password changes. Through traffic monitoring and log analysis, real-time responses are made to abnormal access and interception is carried out to prevent attackers from invading the platform through vulnerabilities; Zhaq ≥ K indicates that the security protection of the platform has reached a qualified level, but it still needs to be optimized and consolidated regularly to prevent the emergence of new security risks and attack methods. The user's transaction behavior, login habits, and network access patterns are monitored in real time, and combined with deep learning models, the platform's ability to identify potential fraud behaviors such as abnormal transactions and illegal logins is continuously improved, and the phenomena of false positives and false negatives are reduced.

7. The Internet data security protection system based on intelligent algorithm according to claim 1 is characterized by: The dynamic identity authentication module includes a multi-factor identity authentication unit, a user device monitoring unit, and a dynamic behavior analysis unit; The multi-factor identity authentication unit is used to perform identity authentication by combining multi-factor identity authentication means such as SMS verification codes, fingerprint recognition, and dynamic passwords when the user logs in and transacts to ensure the legitimacy of the user's identity; The user device monitoring unit is used to analyze the user's login behavior pattern by monitoring the user's device ID, IP address and geographic location information to determine whether there is abnormal login behavior and trigger further identity verification; The dynamic behavior analysis unit is used to analyze the dynamic changes of the user's behavior in combination with the user's historical login and transaction behaviors, detect in real time whether the user has abnormal behavior, and provide real-time security feedback for abnormal behavior.

8. The Internet data security protection system based on intelligent algorithm according to claim 1 is characterized by: The intrusion protection module includes a network traffic monitoring unit, an abnormal request identification unit and an attack defense response unit; The network traffic monitoring unit is used to monitor the network traffic of the platform in real time, and analyze network requests in combination with the convolutional neural network (CNN) deep learning model to identify potential malicious requests or attack behaviors; The abnormal request identification unit identifies abnormal network request patterns, including frequent IP requests and abnormal access time periods, through a machine learning algorithm to identify potential intrusion behaviors; The attack defense response unit is used to respond to malicious attack behaviors through automated rules, and immediately initiate defense measures when an attack is detected, including IP blocking and traffic speed limiting.

9. The Internet data security protection system based on intelligent algorithm according to claim 1 is characterized by: The safety feedback automatic response module includes a safety event monitoring unit and an automatic response unit; The security event monitoring unit is used to monitor the security events of the platform in real time and detect potential security threats, including data leakage and account anomalies. The monitoring content includes user behavior, system logs and transaction data; The automated response unit is used to automatically initiate corresponding protective measures according to the type and severity of the security incident, including freezing accounts, restricting logins, and encrypting transmissions, and to provide real-time feedback to platform security managers on the implementation status and effects of emergency response measures.

10. An Internet data security protection method based on an intelligent algorithm, applied to an Internet data security protection system based on an intelligent algorithm as claimed in any one of claims 1 to 9, characterized in that: The following steps are involved: Step 1: Collect user behavior data in real time through log records, sensors and API interfaces, including login information, browsing history, transaction records and IP addresses. By monitoring users' real-time operation behaviors, analyze their interaction patterns on the platform, including browsing time, frequent operations and transaction amounts; Step 2: Encrypt sensitive data, including user account information, payment passwords, and transaction records, using symmetric encryption AES or asymmetric encryption RSA, TLS / SSL protocol to ensure encryption during data transmission, combined with quantum encryption technology to provide a higher level of security during data transmission; Step 3: Use machine learning models such as random forest, support vector machine (SVM) or deep learning models to analyze the user's transaction behavior and payment method, and calculate and obtain: user behavior security factor Yhxw, data transmission security factor Sjcs and risk protection response factor Fxfh, identify potential fraudulent behaviors, including card theft, false transactions and money laundering, and conduct dynamic risk assessment based on the user's historical behavior, transaction amount, geographic location and payment device data, and obtain the assessment plan after threshold comparison; Step 4: When logging in and making transactions, we use a combination of multiple authentication methods, including SMS verification code, fingerprint recognition and dynamic passwords to authenticate users, and use intelligent algorithms to analyze the user's device ID, login IP and geographic location to dynamically monitor the security of login behavior; Step 5: Through deep learning models, including convolutional neural networks (CNN) and long short-term memory networks (LSTM), we analyze network traffic and platform logs, detect abnormal access and malicious requests or DDOS attacks in real time, and automatically identify and block abnormal behaviors or attacks based on preset security rules; Step 6: Monitor the platform's security incidents in real time, promptly provide feedback on abnormalities or attack information, and automatically respond to security threats by triggering preset emergency measures including restricting account logins, freezing funds, and encrypting transmissions.

Images