Safety management method for overseas bidding and tendering platform

Abstract

The invention discloses a safety management method for an overseas bidding and tendering platform, which relates to the technical field of system management and comprises the following steps of: logging in the platform by adopting a dual identity authentication mechanism; setting an abnormal flow detection and protection mechanism; establishing an intelligent authority management mechanism; encrypting sensitive data of bidding and tendering; implementing a distributed backup and disaster recovery strategy; security auditing is carried out on external suppliers and partners; real-time monitoring and log auditing are carried out; deploying an intelligent contract auditing and verifying mechanism; constructing a malicious behavior recognition system based on artificial intelligence; and performing dynamic vulnerability scanning and timely patch management. According to the overseas bidding and tendering platform security management method, by introducing a multi-dimensional and intelligent security protection mechanism, the security of the platform is comprehensively improved from the aspects of user identity verification, authority management, flow protection, abnormal behavior detection and the like, so that the method can monitor and adjust the user authority in real time, and the authority abuse is prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of system management, and in particular to a security management method for an overseas bidding platform. Background Art

[0002] With the advancement of globalization, overseas bidding platforms, as an important channel for cross-border transactions and cooperation, have become a key tool for many companies to participate in international competition. However, due to its openness and complexity, the security of the platform faces many challenges, especially in terms of user identity authentication, traffic protection, and data protection. Existing security management measures mostly rely on traditional authentication, data encryption, and static firewall technologies. These measures usually protect against known threats and attack patterns, and lack real-time detection and response to new attack methods, abnormal behaviors, and dynamic traffic patterns. Therefore, traditional security protection methods often appear to be powerless when facing highly complex and evolving security threats. For example, a single authentication method is vulnerable to identity theft and abuse of rights, a static permission management mechanism cannot flexibly respond to dynamically changing user behaviors, and a traffic protection system may not be able to cope with large-scale distributed denial of service (DDoS) attacks and other large-volume attacks. In addition, with the continuous development of machine learning and artificial intelligence, existing security protection mechanisms have failed to make full use of these advanced technologies to achieve intelligent analysis of user behavior and network traffic, and cannot provide more accurate and dynamic security protection. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a method for secure management of an overseas bidding platform to solve the problems raised in the above background technology.

[0004] To achieve the above object, the present invention provides the following technical solution: a method for managing the security of an overseas bidding platform, comprising the following steps:

[0005] S1. Use dual identity authentication mechanism to log in to the platform;

[0006] S2. Set up abnormal traffic detection and protection mechanism;

[0007] S3. Establish an intelligent rights management mechanism;

[0008] S4. Encrypt sensitive bidding data;

[0009] S5. Implement distributed backup and disaster recovery strategies;

[0010] S6. Conduct security audits on external suppliers and partners;

[0011] S7. Implement real-time monitoring and log auditing;

[0012] S8. Deploy smart contract audit and verification mechanism;

[0013] S9. Build a malicious behavior identification system based on artificial intelligence;

[0014] S10. Dynamic vulnerability scanning and timely patch management.

[0015] To further optimize the technical solution, in step S1, two different authentication methods are required when the user logs in, including a password plus a dynamic verification code, and a fingerprint recognition and SMS verification code method;

[0016] The platform chooses to use hardware-based authentication devices U2F and YubiKey as authentication methods. The dual identity authentication mechanism is tightly integrated with the platform's login mechanism. Users must undergo two-factor authentication every time they log in or perform sensitive operations.

[0017] To further optimize the technical solution, in step S2, the abnormal traffic detection and protection mechanism is used to identify abnormal traffic that is different from normal user behavior, and automatically take downgrade measures for high-frequency access requests, delay processing of individual requests, use verification codes to verify whether the user is a human, or temporarily restrict the access rights of abnormal IPs;

[0018] Combined with cloud protection services, cloud protection is automatically enabled when traffic explodes, ensuring that the platform will not be paralyzed when facing large-scale traffic attacks.

[0019] To further optimize the technical solution, in the abnormal traffic detection and protection mechanism, an abnormal detection model based on traffic behavior is constructed. The model identifies abnormal traffic and automatically responds to protection by analyzing the characteristics of access requests, and defines the following important variables:

[0020] T: time window of total traffic;

[0021] L(t): Traffic intensity at time point t, indicating the total number of access requests within time t;

[0022] N(t): the number of unique user accesses at time point t, indicating the number of access requests initiated by different IP addresses or devices;

[0023] A(t): average request response time at time point t;

[0024] R(t): request response success rate within time t, defined as the ratio of successful response requests;

[0025] S(t): abnormal traffic score at time point t, indicating the degree of abnormality of the traffic in the time window;

[0026] C(t): the change rate of request type, indicating the change of different request types;

[0027] I(t): The number of abnormal IP requests, which indicates the number of requests from a single IP or IP range in a short period of time;

[0028] Quantify the degree of traffic anomaly and calculate the abnormal traffic score S(t) in each time window T. The score consists of the following dimensions:

[0029]

[0030] Among them, α, β, γ, δ, θ, and κ are the weight coefficients of each indicator, indicating the influence of these factors on the abnormal traffic score. The weights need to be adjusted according to the actual needs of the platform.

[0031] To further optimize the technical solution, in the abnormal traffic detection and protection mechanism, based on the calculated abnormal traffic score, protective measures are taken according to the following strategies:

[0032] Anomaly detection threshold:

[0033] Define a threshold. When the abnormal traffic score exceeds the threshold, the platform considers that there is abnormal traffic. The threshold can be dynamically adjusted according to the platform load and traffic characteristics.

[0034] Protective measures:

[0035] Traffic downgrade: When the abnormal traffic score exceeds the threshold, the traffic downgrade process is automatically carried out, the request is delayed, and a large number of requests are processed gradually to avoid the platform being overwhelmed instantly; a verification code is sent to the user to ensure that the request source is a real user, not an automated script;

[0036] IP blocking: When a specific IP or IP segment is found to have frequent requests, the platform will temporarily block the IP and block its access rights;

[0037] Traffic is forwarded to the cloud for protection. Combined with the cloud protection service, when the local resources of the platform are attacked, the abnormal traffic is forwarded to the cloud for protection and processing to ensure the normal operation of the platform;

[0038] Alarm and manual intervention: When extremely abnormal traffic is detected, an alarm is automatically sent to notify the administrator, enabling the manual intervention process for further inspection and protection.

[0039] To further optimize the technical solution, in step S3, the intelligent permission management mechanism continuously analyzes the user's behavior changes and intelligently adjusts the permissions;

[0040] When the system finds a sudden change in a user's operating behavior, that is, a large number of bids are frequently submitted or large transactions occur in a short period of time, the system responds through the following mechanisms:

[0041] Real-time monitoring: The platform monitors user behavior patterns by calculating the real-time value of permission levels. If a user's permissions increase too much, it will automatically trigger a security alert or require further verification, including verification codes and manual review.

[0042] Model-based prediction: Using historical data for prediction, AI algorithms predict users’ future behavior based on their historical behavior and permission change trends, and adjust their permissions in advance to avoid potential security risks.

[0043] Multi-level approval mechanism: For high-risk operations, including high-value transactions and contract signing, the user's permission upgrade request will be handled by a multi-level approval mechanism. Whenever the value of the permission level exceeds a certain threshold, the approval process will be automatically triggered and the operation authority will be submitted to the administrator for review.

[0044] To further optimize this technical solution, in the intelligent permission management mechanism, a permission dynamic adjustment model based on user behavior is constructed, and intelligent analysis is performed in combination with machine learning algorithms;

[0045] User behavior on the platform is analyzed across multiple dimensions, including user role, access frequency, operation type, and transaction amount. The model is constructed by defining the following variables:

[0046] U: user set, including all platform users;

[0047] R u : The role set of user u, indicating the user's authority role, such as supplier, buyer, administrator;

[0048] A u (t): the set of operations performed by user u at time t, including logging in, viewing bidding information, submitting bids, and signing contracts;

[0049] F u (t): the access frequency of user u at time t, expressed as the number of visits per unit time;

[0050] M u (t): transaction amount of user u in time t;

[0051] P u (t): permission level of user u at time t;

[0052] Permission Level P u (t) is calculated by the following formula:

[0053] Pu (t) = P0 × (1 + α·ΔF u (t)+β·ΔM u (t)+γ·ΔA u (t)).

[0054] To further optimize the technical solution, in step S4, the platform encrypts the user information, bidding data and contract information, uses the AES-256 encryption standard to encrypt and store the data, and uses the SSL / TLS protocol to encrypt the data transmission;

[0055] Sensitive information including bank card numbers and ID card numbers are encrypted at the field level to prevent a large amount of personal information from being leaked when the database is attacked;

[0056] The platform rotates keys regularly and follows the principle of least privilege in the key management process, that is, only authorizing specific personnel or systems to access keys.

[0057] To further optimize the technical solution, in step S5:

[0058] First, the platform distributes data backup in different geographical locations, using cloud computing resources or multiple data centers for off-site backup; the backup includes not only the operating system, database, and application data, but also the platform's configuration files and log files, ensuring that the system can be fully restored in the event of a disaster;

[0059] Secondly, the platform regularly conducts backup and recovery drills to ensure rapid business recovery in emergency situations and minimize system downtime;

[0060] Disaster recovery plans include different types of scenarios and emergency response processes, how to quickly switch to a backup machine when a host fails, and how to deal with data corruption scenarios.

[0061] To further optimize the technical solution, in step S7, the platform monitors various key indicators of the system, including user login activities, data access behaviors, and transaction records, and combines artificial intelligence technology to perform automated analysis to promptly discover suspicious behavior patterns;

[0062] The platform sets threshold rules. If a user account is found to log in or operate abnormally frequently within a short period of time, an alarm will be automatically generated and the operation will be suspended.

[0063] At the same time, the platform keeps detailed logs of all key operations, recording information on every data modification, user behavior, and system access.

[0064] To further optimize the technical solution, in step S8, the platform introduces an automated code analysis tool to perform static analysis on the smart contract to ensure that there are no known security vulnerabilities or potential attack points;

[0065] In addition, the platform has established a manual review mechanism, combining legal experts and blockchain experts to conduct in-depth reviews of the contents of smart contracts; before the smart contract is released, the platform conducts simulation tests to ensure that the execution results under different conditions meet expectations.

[0066] Further optimizing the technical solution, in step S9, the malicious behavior identification system analyzes all operation data of the platform in real time, including user behavior, transaction records, IP addresses, and device fingerprints, and automatically identifies potential fraudulent behavior and malicious attacks;

[0067] The AI ​​algorithm gradually improves the accuracy of identifying malicious behavior by learning normal and abnormal patterns in historical data, allowing the system to identify unconventional bidding behaviors, such as abnormal low-price bidding and multiple accounts operating with the same IP, and promptly alert platform administrators for further investigation. The system is also combined with other security protection measures including verification codes and IP bans to achieve automated protection.

[0068] Compared with the prior art, the present invention provides a method for managing the safety of an overseas bidding platform, which has the following beneficial effects:

[0069] The security management method of the overseas bidding platform improves the security of the platform from all aspects, from user identity authentication, permission management, traffic protection to abnormal behavior detection, by introducing a multi-dimensional and intelligent security protection mechanism. The method can monitor and adjust user permissions in real time to prevent abuse of permissions; the abnormal traffic detection and protection mechanism combines real-time traffic analysis and cloud-based collaborative protection to effectively identify and block malicious traffic and avoid the impact of large-scale traffic attacks such as DDoS attacks. At the same time, the permission management mechanism is adjusted in real time in combination with user behavior and access patterns, which improves the platform's ability to prevent internal and external threats, thereby improving the overall security level of the platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A schematic diagram of a process for a safety management method for an overseas bidding platform proposed by the present invention;

[0071] Figure 2 A schematic diagram of the process of an intelligent authority management mechanism in a security management method for an overseas bidding platform proposed by the present invention;

[0072] Figure 3 This is a schematic diagram of the composition of the abnormal traffic monitoring and protection mechanism in the overseas bidding platform security management method proposed by the present invention. DETAILED DESCRIPTION

[0073] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] Embodiment 1:

[0075] See also Figure 1 , a method for security management of an overseas bidding platform, comprising the following steps:

[0076] S1. Use dual identity authentication mechanism to log in to the platform

[0077] In this embodiment, two different authentication methods are required when the user logs in, including a password plus a dynamic verification code, and a fingerprint recognition and SMS verification code method;

[0078] The platform uses hardware-based authentication devices U2F and YubiKey as authentication methods. The dual identity authentication mechanism is tightly integrated with the platform's login mechanism. Users must undergo dual identity authentication every time they log in or perform sensitive operations. This method not only reduces the possibility of account hijacking, but also effectively protects account security in the event of password leakage or social engineering attacks.

[0079] S2. Set up abnormal traffic detection and protection mechanism

[0080] In this embodiment, the abnormal traffic detection and protection mechanism is used to identify abnormal traffic that is different from normal user behavior, and automatically take downgrade measures for high-frequency access requests, delay processing of individual requests, use verification codes to verify whether the user is a human, or temporarily restrict the access rights of abnormal IPs;

[0081] Combined with cloud protection services, cloud protection is automatically enabled when traffic explodes, ensuring that the platform will not be paralyzed when facing large-scale traffic attacks.

[0082] S3. Establish an intelligent rights management mechanism

[0083] In this embodiment, the intelligent permission management mechanism continuously analyzes the user's behavior changes and intelligently adjusts permissions;

[0084] When the system finds a sudden change in a user's operating behavior, that is, a large number of bids are frequently submitted or large transactions occur in a short period of time, the system responds through the following mechanisms:

[0085] Real-time monitoring: The platform monitors user behavior patterns by calculating the real-time value of permission levels. If a user's permissions increase too much, it will automatically trigger a security alert or require further verification, including verification codes and manual review.

[0086] Model-based prediction: Using historical data for prediction, AI algorithms predict users’ future behavior based on their historical behavior and permission change trends, and adjust their permissions in advance to avoid potential security risks.

[0087] Multi-level approval mechanism: For high-risk operations, including high-value transactions and contract signing, the user's permission upgrade request will be handled by a multi-level approval mechanism. Whenever the value of the permission level exceeds a certain threshold, the approval process will be automatically triggered and the operation authority will be submitted to the administrator for review.

[0088] S4. Encrypt sensitive bidding data

[0089] In this embodiment, in order to ensure the security of sensitive data on the platform, the platform encrypts user information, bidding data, and contract information, uses the AES-256 encryption standard to encrypt and store data, and uses the SSL / TLS protocol to encrypt data transmission;

[0090] Sensitive information including bank card numbers and ID card numbers are encrypted at the field level to prevent a large amount of personal information from being leaked when the database is attacked;

[0091] The leakage or abuse of keys is a huge hidden danger to data security, so the platform needs to rotate keys regularly and follow the principle of least privilege in the key management process, that is, only authorize specific people or systems to access keys. Through these measures, the platform can ensure the security of sensitive data and effectively prevent the risk of information leakage.

[0092] S5. Implement a distributed backup and disaster recovery strategy

[0093] In this embodiment, in order to cope with various unexpected security incidents that the platform may encounter (such as hacker attacks, natural disasters, etc.), the platform needs to establish a sound disaster recovery mechanism and distributed backup solution. First, the platform distributes data backups in different geographical locations, and performs off-site backups through cloud computing resources or multiple data centers; the backup includes not only the operating system, database, and application data, but also the platform's configuration files and log files, ensuring that the system can be fully restored in the event of a disaster;

[0094] Secondly, the platform regularly conducts backup and recovery drills to ensure rapid business recovery in emergency situations and minimize system downtime;

[0095] Disaster recovery plans include different types of scenarios and emergency response processes, how to quickly switch to a backup machine when a host fails, and how to deal with data corruption scenarios.

[0096] S6. Conduct security audits on external suppliers and partners

[0097] In this embodiment, in the overseas bidding platform, the cooperation between the platform and external suppliers and partners involves a large amount of data exchange and sharing. In order to reduce the security risks brought by external cooperation, the platform should conduct security audits on external suppliers and partners. First of all, the platform should evaluate the supplier's security measures to ensure that it has sufficient security protection capabilities to avoid the overall security of the platform being affected by security vulnerabilities of external suppliers. For example, the platform may require partners to provide security certification (such as ISO 27001 certification) or conduct regular security assessments. In addition, the platform should verify the supplier's security measures through a third-party security audit agency to ensure that they meet the platform's security standards. Through these measures, the platform can effectively identify potential supply chain security risks and take corresponding preventive measures.

[0098] S7. Implement real-time monitoring and log auditing

[0099] In this embodiment, in step S7, the platform monitors various key indicators of the system, including user login activities, data access behaviors, and transaction records, and combines artificial intelligence technology to perform automated analysis to promptly discover suspicious behavior patterns;

[0100] The platform sets threshold rules. If a user account is found to log in or operate abnormally frequently within a short period of time, an alarm will be automatically generated and the operation will be suspended.

[0101] At the same time, the platform retains detailed logs of all key operations, recording every data modification, user behavior, and system access information. These logs not only facilitate post-event tracing and security audits, but also provide important data support for daily security analysis.

[0102] S8. Deployment of smart contract audit and verification mechanism

[0103] In this embodiment, in some international bidding platforms, smart contracts are widely used for automated transactions and contract execution. In order to ensure the security of smart contracts, the platform should establish a review and verification mechanism for smart contracts. The platform introduces automated code analysis tools to perform static analysis on smart contracts to ensure that there are no known security vulnerabilities or potential attack points;

[0104] In addition, the platform has established a manual review mechanism, combining legal experts and blockchain experts to conduct in-depth reviews of the content of smart contracts; before the release of smart contracts, the platform conducts simulation tests to ensure that the execution results under different conditions meet expectations. Through these measures, the platform can greatly reduce the potential security risks of smart contracts and ensure the fairness and security of bidding transactions.

[0105] S9. Build a malicious behavior identification system based on artificial intelligence

[0106] In this embodiment, the malicious behavior identification system analyzes all operation data of the platform in real time, including user behavior, transaction records, IP addresses, and device fingerprints, and automatically identifies potential fraudulent behavior and malicious attacks;

[0107] The AI ​​algorithm gradually improves the accuracy of identifying malicious behavior by learning normal and abnormal patterns in historical data, allowing the system to identify unconventional bidding behaviors, such as abnormal low-price bidding and multiple accounts operating with the same IP, and promptly alert platform administrators for further investigation. The system is also combined with other security protection measures including verification codes and IP bans to achieve automated protection.

[0108] S10, Dynamic vulnerability scanning and timely patch management

[0109] In this embodiment, the platform regularly performs dynamic vulnerability scans on the system to promptly discover potential security vulnerabilities. In addition to conventional static code analysis, dynamic scanning tests the real-time protection capabilities of the platform by simulating attacks and other means. For example, the platform can regularly conduct penetration tests to simulate hacker attack methods and detect the security of the platform under different attack scenarios. At the same time, the platform should set up a special vulnerability management team to regularly check and fix known vulnerabilities in the system. In terms of patch management, the platform should introduce an automated patch deployment system as soon as possible, and after confirming the existence of vulnerabilities, quickly release and apply patches to prevent attackers from exploiting vulnerabilities to attack. In addition, the platform should maintain close contact with the security community and obtain security notices and patch updates about vulnerabilities as soon as possible.

[0110] Embodiment 2:

[0111] See also Figure 2 and Figure 3 , Based on the overseas bidding platform security management method described in Example 1, in step S2, the abnormal traffic detection and protection mechanism is actually applied.

[0112] In overseas bidding platforms, abnormal traffic detection and protection are important links to ensure stable operation of the platform and resist attacks such as DDoS (distributed denial of service). In order to achieve efficient abnormal traffic detection and protection mechanism, machine learning and rule-based models can be combined to analyze traffic behavior, identify abnormal traffic in real time and take corresponding protection measures.

[0113] Build an anomaly detection model based on traffic behavior. This model identifies abnormal traffic and automatically responds to it by analyzing the characteristics of access requests. First, define the following important variables:

[0114] T: time window of total traffic, in seconds (for example, T = 60 seconds, indicating the number of visits per minute).

[0115] L(t): Traffic intensity at time point t, indicating the total number of access requests within time t.

[0116] N(t): The number of unique user visits at time point t, indicating the number of access requests initiated by different IP addresses or devices.

[0117] A(t): average request response time at time point t.

[0118] R(t): Request response success rate within time t, defined as the ratio of successful response requests (i.e., number of successful requests / total number of requests).

[0119] S(t): The abnormal traffic score at time point t, indicating the degree of abnormality of the traffic in this time window.

[0120] C(t): The change rate of request type, indicating the changes in different request types (for example, API requests, page requests, etc.).

[0121] I(t): The number of abnormal IP requests, which indicates the number of requests from a single IP or IP range in a short period of time.

[0122] In order to quantify the degree of traffic anomaly, we first need to calculate the abnormal traffic score S(t) in each time window T. The score consists of the following dimensions:

[0123]

[0124] Among them, α, β, γ, δ, θ, κ are the weight coefficients of each indicator, indicating the influence of these factors on the abnormal traffic score. The weight needs to be adjusted according to the actual needs of the platform.

[0125] L avg , N avg , A avg , R avg , C avg, I avg It is the average value of historical traffic data and serves as a benchmark reference value.

[0126] In the above formula,

[0127] Traffic intensity ratio This item is used to measure the increase in traffic requests per unit time. If the traffic in the current period exceeds the historical average by a significant percentage, it indicates that there may be a DDoS attack or other types of traffic anomalies.

[0128] Unique User Ratio This reflects the request frequency of different IPs or devices. When the number of requests from a certain IP or device increases significantly, it may mean that the IP is under attack or that a malicious robot is making a large number of requests.

[0129] Average response time ratio If the request response time for a period of time is significantly higher than normal, it indicates that the system may be congested due to excessive traffic, which is also a common manifestation of DDoS attacks.

[0130] Request response success rate Abnormal traffic is often accompanied by requests with a high failure rate. If a large number of requests fail (such as server failure to respond, request timeout, etc.), it means that the platform has encountered difficulties in processing traffic, and the server may be overloaded due to traffic attacks.

[0131] Request type change rate If the platform's request type changes abnormally within a short period of time (for example, from regular page requests to a large number of API requests or other background interface requests), it may be that the attacker is trying to bypass protection or conduct large-scale scanning through specific request methods.

[0132] Abnormal 1P request ratio A large number of requests coming from a single IP or IP range usually indicates that the IP is under attack. By monitoring the request frequency of abnormal IPs, the source traffic can be effectively blocked.

[0133] Furthermore, in the abnormal traffic detection and protection mechanism, based on the calculated abnormal traffic score, protective measures are taken according to the following strategies:

[0134] Anomaly detection threshold:

[0135] Define a threshold. When the abnormal traffic score exceeds the threshold, the platform considers that there is abnormal traffic. The threshold can be dynamically adjusted according to the platform load and traffic characteristics.

[0136] Protective measures:

[0137] Traffic downgrade: When the abnormal traffic score exceeds the threshold, the traffic downgrade process is automatically carried out, the request is delayed, and a large number of requests are processed gradually to avoid the platform being overwhelmed instantly; a verification code is sent to the user to ensure that the request source is a real user, not an automated script;

[0138] IP blocking: When a specific IP or IP segment is found to have frequent requests, the platform will temporarily block the IP and block its access rights;

[0139] Traffic is forwarded to the cloud for protection. Combined with the cloud protection service, when the local resources of the platform are attacked, the abnormal traffic is forwarded to the cloud for protection and processing to ensure the normal operation of the platform;

[0140] Alarm and manual intervention: When extremely abnormal traffic is detected, an alarm is automatically sent to notify the administrator, enabling the manual intervention process for further inspection and protection.

[0141] The model can calculate the traffic anomaly score in each time window in real time and automatically adjust the protection strategy based on the score results. When the platform has traffic anomalies, it can take timely measures such as downgrade processing and IP blocking to ensure the stability of the platform when facing malicious traffic attacks.

[0142] In order to adapt to the traffic fluctuations of the platform under different loads, the threshold can be dynamically adjusted according to the current traffic and load conditions of the platform. This means that the system can continuously optimize the protection response strategy according to the real-time traffic environment.

[0143] Combined with the cloud protection mechanism, when the local system traffic is too large, the traffic can be automatically forwarded to the cloud protection to avoid platform downtime due to traffic attacks.

[0144] In step S3, the intelligent rights management mechanism is actually applied.

[0145] In the security management of overseas bidding platforms, the core purpose of intelligent permission management is to reduce internal risks by dynamically adjusting permission control and intelligently analyzing user behavior. To this end, we build a dynamic permission adjustment model based on user behavior and combine it with machine learning algorithms for intelligent analysis.

[0146] Assume that user behavior on the platform can be analyzed through multiple dimensions, including user role, access frequency, operation type, transaction amount, etc. The model is constructed by defining the following variables:

[0147] U: User collection, including all platform users.

[0148] R u : A collection of roles for a user, representing the user's authority roles, such as supplier, buyer, administrator, etc.

[0149] A u (t): The set of operations performed by user u at time t, including logging in, viewing bidding information, submitting bids, signing contracts, etc.

[0150] F u (t): The access frequency of user u at time t, which can be expressed as the number of visits per unit time.

[0151] M u (t): Transaction amount of user u in time t (only for operations involving amount such as bidding, payment, etc.).

[0152] P u (t): permission level of user u at time t.

[0153] Permission Level P u (t) can be calculated by the following formula:

[0154] P u (t) = P0 × (1 + α·ΔF u (t)+β·ΔM u (t)+γ·ΔA u (t)

[0155] in,

[0156] P0: User initial permission level.

[0157] α, β, γ: weight coefficients, which respectively represent the influence of access frequency, transaction amount and operation type on the permission level. They need to be adjusted according to the needs of the platform.

[0158] ΔF u (t): The increment of user access frequency, that is, the change compared with the past access frequency.

[0159] ΔM u (t): The increment of the user's transaction amount, that is, the change compared with the past transaction amount.

[0160] ΔA u (t): The incremental change in the type of user operations, used to measure whether the user has performed some unusual high-authority operations (for example, high-value bidding or contract signing, etc.).

[0161] In practical application:

[0162] Initial permission level P0: The initial permissions of a user are determined by their role. For example, a supplier may have the permission to view bidding information and submit bids, while an administrator has higher permissions, such as managing user accounts and publishing bidding information.

[0163] Access frequency increment ΔFu (t): If a user frequently accesses the platform and performs sensitive operations (such as frequent logins, submitting a large number of bids), the system will consider their behavior pattern to be abnormal, and dynamically increase their permissions or trigger a warning. For users with frequent behavior, it may mean higher permission requirements or potential risks. The system will automatically adjust their permissions based on the frequency of access.

[0164] Transaction amount increment ΔM u (t): A sharp increase in transaction amount usually means that the user is making an important bid or contract signing operation. The system can determine whether the user's permissions need to be adjusted by detecting the increase in the user's transaction amount within a specific time period. For example, if a user has recently submitted multiple high-value bids, the system can automatically increase his permissions or trigger the approval process for manual review.

[0165] Operation type increment ΔA u (t): The more types of actions a user performs on the platform, especially those that involve high-risk operations (such as contract signing, cross-border payments, etc.), the greater the increment in permission levels. For example, if a user moves from just submitting a bid to participating in a contract signing or making a fund transfer, the system will detect this role change and increase permissions or require multiple layers of approval accordingly.

[0166] Based on the above mechanism, user permissions no longer rely on static roles, but are dynamically adjusted according to actual operations and behaviors, so that any potential risks can be responded to in a timely manner. For example, when a supplier's permissions suddenly increase due to abnormal operations or high-frequency bidding, the system will automatically adjust its operating scope and require additional approval or verification.

[0167] By using an intelligent permission management mechanism, the platform can more accurately control the permissions of each user and take timely response measures when user behavior is abnormal, thereby reducing the risks caused by internal malicious behavior or operational errors.

[0168] Based on the behavioral characteristics of different users, the platform can implement more personalized security policies. For example, the permissions of some regular suppliers or buyers may be relatively fixed, while newly registered users or users whose behaviors change frequently may require more frequent permission reviews and dynamic adjustments.

[0169] The beneficial effects of the present invention are:

[0170] The security management method of the overseas bidding platform improves the security of the platform from all aspects, from user identity authentication, permission management, traffic protection to abnormal behavior detection, by introducing a multi-dimensional and intelligent security protection mechanism. The method can monitor and adjust user permissions in real time to prevent abuse of permissions; the abnormal traffic detection and protection mechanism combines real-time traffic analysis and cloud-based collaborative protection to effectively identify and block malicious traffic and avoid the impact of large-scale traffic attacks such as DDoS attacks. At the same time, the permission management mechanism is adjusted in real time in combination with user behavior and access patterns, which improves the platform's ability to prevent internal and external threats, thereby improving the overall security level of the platform.

[0171] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0172] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for security management of overseas bidding platforms, characterized in that: The following steps are involved: S1. Use dual identity authentication mechanism to log in to the platform; S2. Set up abnormal traffic detection and protection mechanism; S3. Establish an intelligent rights management mechanism; S4. Encrypt sensitive bidding data; S5. Implement distributed backup and disaster recovery strategies; S6. Conduct security audits on external suppliers and partners; S7. Implement real-time monitoring and log auditing; S8. Deploy smart contract audit and verification mechanism; S9. Build a malicious behavior identification system based on artificial intelligence; S10. Dynamic vulnerability scanning and timely patch management.

2. According to claim 1, a method for managing the safety of an overseas bidding platform is characterized in that: In step S1, two different authentication methods are required when the user logs in, including a password plus a dynamic verification code, and a fingerprint recognition and SMS verification code method; The platform chooses to use hardware-based authentication devices U2F and YubiKey as authentication methods. The dual identity authentication mechanism is tightly integrated with the platform's login mechanism. Users must undergo two-factor authentication every time they log in or perform sensitive operations.

3. According to claim 1, a method for managing the safety of overseas bidding platforms is characterized in that: In step S2, the abnormal traffic detection and protection mechanism is used to identify abnormal traffic that is different from normal user behavior, and automatically take downgrade measures for high-frequency access requests, delay processing of individual requests, use verification codes to verify whether the user is a human, or temporarily restrict the access rights of abnormal IPs; Combined with cloud protection services, cloud protection is automatically enabled when traffic explodes, ensuring that the platform will not be paralyzed when facing large-scale traffic attacks.

4. According to claim 3, a method for managing the safety of overseas bidding platforms is characterized in that: In the abnormal traffic detection and protection mechanism, an abnormal detection model based on traffic behavior is constructed. The model identifies abnormal traffic and automatically responds to protection by analyzing the characteristics of access requests, and defines the following important variables: T: time window of total traffic; L(t): Traffic intensity at time point t, indicating the total number of access requests within time t; N(t): the number of unique user visits at time point t, indicating the number of access requests initiated by different IP addresses or devices; A(t): average request response time at time point t; R(t): request response success rate within time t, defined as the ratio of successful response requests; S(t): abnormal traffic score at time point t, indicating the abnormal degree of traffic in the time window; C(t): the change rate of request type, indicating the change of different request types; I(t): The number of abnormal IP requests, which indicates the number of requests from a single IP or IP range in a short period of time; Quantify the degree of traffic anomaly and calculate the abnormal traffic score S(t) in each time window T. The score is composed of the following dimensions composition: Among them, α, β, γ, δ, θ, and κ are the weight coefficients of each indicator, indicating the influence of these factors on the abnormal traffic score. The weights need to be adjusted according to the actual needs of the platform.

5. According to claim 4, a method for managing the safety of overseas bidding platforms is characterized in that: In the abnormal traffic detection and protection mechanism, based on the calculated abnormal traffic score, protective measures are taken according to the following strategies: Anomaly detection threshold: Define a threshold. When the abnormal traffic score exceeds the threshold, the platform considers that there is abnormal traffic. The threshold can be dynamically adjusted according to the platform load and traffic characteristics. Protective measures: Traffic downgrade: When the abnormal traffic score exceeds the threshold, the traffic downgrade process is automatically carried out, the request is delayed, and a large number of requests are processed gradually to avoid the platform being overwhelmed instantly; a verification code is sent to the user to ensure that the request source is a real user, not an automated script; IP blocking: When a specific IP or IP segment is found to have frequent requests, the platform will temporarily block the IP and block its access rights; Traffic is forwarded to the cloud for protection. Combined with the cloud protection service, when the local resources of the platform are attacked, the abnormal traffic is forwarded to the cloud for protection and processing to ensure the normal operation of the platform; Alarm and manual intervention: When extremely abnormal traffic is detected, an alarm is automatically sent to notify the administrator, enabling the manual intervention process for further inspection and protection.

6. The overseas bidding platform security management method according to claim 1 is characterized in that: In step S3, the intelligent permission management mechanism continuously analyzes the user's behavior changes and intelligently adjusts the permissions; When the system finds a sudden change in a user's operating behavior, that is, a large number of bids are frequently submitted or large transactions occur in a short period of time, the system responds through the following mechanisms: Real-time monitoring: The platform monitors user behavior patterns by calculating the real-time value of permission levels. If a user's permissions increase too much, it will automatically trigger a security alert or require further verification, including verification codes and manual review. Model-based prediction: Using historical data for prediction, AI algorithms predict users’ future behavior based on their historical behavior and permission change trends, and adjust their permissions in advance to avoid potential security risks. Multi-level approval mechanism: For high-risk operations, including high-value transactions and contract signing, the user's permission upgrade request will be handled by a multi-level approval mechanism. Whenever the value of the permission level exceeds a certain threshold, the approval process will be automatically triggered and the operation authority will be submitted to the administrator for review.

7. The overseas bidding platform security management method according to claim 6 is characterized in that: In the intelligent permission management mechanism, a permission dynamic adjustment model based on user behavior is constructed, and intelligent analysis is performed in combination with machine learning algorithms; User behavior on the platform is analyzed across multiple dimensions, including user role, access frequency, operation type, and transaction amount. The model is constructed by defining the following variables: U: user set, including all platform users; Ru: the role set of user u, indicating the user's authority role, such as supplier, buyer, administrator; A u (t): the set of operations performed by user u at time t, including logging in, viewing bidding information, submitting bids, and signing contracts; F u (t): the access frequency of user u at time t, expressed as the number of visits per unit time; M u (t): transaction amount of user u in time t; P u (t): permission level of user u at time t; Permission Level P u (t) is calculated by the following formula: P u (t)=P0×(1+α·△F u (t)+β·△M u (t)+γ·△A u (t)).

8. The overseas bidding platform security management method according to claim 1 is characterized in that: In step S4, the platform encrypts the user information, bidding data and contract information, uses the AES-256 encryption standard to encrypt and store the data, and uses the SSL / TLS protocol to encrypt the data transmission; Sensitive information including bank card numbers and ID card numbers are encrypted at the field level to prevent a large amount of personal information from being leaked when the database is attacked; The platform rotates keys regularly and follows the principle of least privilege in the key management process, that is, only authorizing specific personnel or systems to access keys.

9. The overseas bidding platform security management method according to claim 1 is characterized in that: In step S5: First, the platform distributes data backup in different geographical locations, using cloud computing resources or multiple data centers for off-site backup; the backup includes not only the operating system, database, and application data, but also the platform's configuration files and log files, ensuring that the system can be fully restored in the event of a disaster; Secondly, the platform regularly conducts backup and recovery drills to ensure rapid business recovery in emergency situations and minimize system downtime; Disaster recovery plans include different types of scenarios and emergency response processes, how to quickly switch to a backup machine when a host fails, and how to deal with data corruption scenarios.

10. The overseas bidding platform security management method according to claim 1, characterized in that: In step S7, the platform monitors various key indicators of the system, including user login activities, data access behaviors, and transaction records, and combines artificial intelligence technology to perform automated analysis to promptly detect suspicious behavior patterns; The platform sets threshold rules. If a user account is found to log in or operate abnormally frequently within a short period of time, an alarm will be automatically generated and the operation will be suspended. At the same time, the platform keeps detailed logs of all key operations, recording information on every data modification, user behavior, and system access.

11. The overseas bidding platform security management method according to claim 1, characterized in that: In step S8, the platform introduces an automated code analysis tool to perform static analysis on the smart contract to ensure that there are no known security vulnerabilities or potential attack points; In addition, the platform has established a manual review mechanism, combining legal experts and blockchain experts to conduct in-depth reviews of the contents of smart contracts; before the smart contract is released, the platform conducts simulation tests to ensure that the execution results under different conditions meet expectations.

12. The overseas bidding platform security management method according to claim 1, characterized in that: In step S9, the malicious behavior identification system analyzes all operation data of the platform in real time, including user behavior, transaction records, IP addresses, and device fingerprints, and automatically identifies potential fraudulent behavior and malicious attacks; The AI ​​algorithm gradually improves the accuracy of identifying malicious behavior by learning normal and abnormal patterns in historical data, allowing the system to identify bidding behaviors that are inconsistent with normal practices, such as abnormally low-price bids and multiple accounts operating with the same IP, and promptly alert platform administrators to conduct further investigations. The system is also combined with other security protection measures including verification codes and IP bans to achieve automated protection.

Images