Computer network big data security protection method and system

Abstract

The invention relates to the field of industrial internet intrusion prevention, in particular to a computer network big data security protection method and system, and the method comprises the following steps: monitoring network flow, collecting user identity, equipment security state, access time and network behavior data, and generating a network behavior record. In the invention, a dynamic security assessment system is constructed through network flow monitoring, identity verification and behavior analysis, and compared with static strategy or fixed rule matching, the dynamic security assessment system can adapt to a continuously changing network attack environment. Authority dynamic adjustment is performed based on the user identity verification state, flexible management and control of the access authority are ensured, and the problem of long-term high authority abuse is avoided. Threat detection not only depends on historical mode matching, but also is combined with real-time behavior analysis, and accurate isolation is executed for potential threats, so that protection measures are changed from passive response to active intervention, and the delay of manual intervention is reduced.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet intrusion prevention, and in particular to a computer network big data security protection method and system. Background Art

[0002] The field of industrial Internet anti-intrusion technology involves the security protection of industrial control systems (ICS), Internet of Things (IoT) devices, cloud data centers and enterprise networks, aiming to prevent malicious attacks, data leaks and system intrusions.

[0003] The existing technology relies on a static defense system that is difficult to adapt to complex attack patterns. Access control uses fixed permission management and fails to adjust in combination with real-time user behavior. Long-term high-privilege accounts may become a hidden danger for internal attacks. Behavior detection is limited to rule matching and lacks the ability to identify unknown attacks. Therefore, improvements are needed. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a computer network big data security protection method and system.

[0005] In order to achieve the above object, the present invention adopts the following technical solution, a computer network big data security protection method, comprising the following steps:

[0006] Conduct network traffic monitoring, collect user identity, device security status, access time, and network behavior data, and generate network behavior records; conduct real-time analysis of the network behavior records, determine potential security threats, and generate security risk assessment results;

[0007] Based on the security risk assessment results, a multi-factor authentication mechanism is applied to verify the user identity and access legitimacy, and obtain the user identity authentication status; based on the user identity authentication status, network access rights are dynamically allocated and a dynamic access rights configuration is generated;

[0008] Based on the security risk assessment results, the source of abnormal behavior or potential threat is isolated and an isolation area setting is generated; the isolation area setting is monitored and a network environment monitoring result is generated;

[0009] The network environment monitoring results are used to evaluate environmental factors and user behaviors, calculate risk factors, and generate comprehensive risk assessment results.

[0010] Preferably, the steps of obtaining the network behavior record are:

[0011] Conduct network traffic monitoring to collect user identity data, device security status, access time, and network behavior data to generate a preliminary data set;

[0012] Based on the preliminary data set, a network behavior record is created, and the network behavior record is generated through record analysis and data collation.

[0013] Preferably, the steps for obtaining the security risk assessment results are:

[0014] Based on the network behavior records, identifying abnormal access behaviors that do not conform to normal patterns, and obtaining an abnormal access behavior data set;

[0015] According to the abnormal access behavior data set, the potential security threat score is calculated using the following formula:

[0016]

[0017] in, Score the security threat. Representative The magnitude of abnormal behavior, is the median of the magnitude of abnormal behavior, Representative The number of packets with abnormal access requests. Representative The latency of an abnormal access request, Representative The number of occurrences of abnormal behavior categories, is the total number of abnormal behavior data, is the number of abnormal access requests, is the number of abnormal behavior categories;

[0018] Based on the security threat score, the security risk level in the current network environment is determined, and a security risk assessment result is generated.

[0019] Preferably, the steps of obtaining the user identity authentication status are:

[0020] Based on the security risk assessment result, a multi-factor authentication mechanism is executed to obtain a user identity authentication status;

[0021] According to the user identity verification status, combined with the abnormal conditions in the network behavior records, the user's access behavior is analyzed to evaluate whether the behavior meets the preset legal standards and obtain the verification result;

[0022] Based on the verification result, user access rights are allocated, and an access rights configuration generation process is performed to obtain user access rights configuration.

[0023] Preferably, the steps of obtaining the dynamic access rights configuration are:

[0024] Based on the user access permission configuration, calculating the user access permission adaptation value;

[0025] Based on the user access permission adaptation value and in combination with user access data, the access permission policy is dynamically adjusted to generate and apply a dynamic access permission configuration.

[0026] Preferably, the steps of obtaining the isolation area settings are:

[0027] Based on the security risk assessment results, analyze network traffic and user behavior, identify abnormal behaviors and potential threat sources that do not comply with security policies, classify and record potential threat sources, and generate a list of potential threat sources;

[0028] Based on the list of potential threat sources, the risk level of each threat source is evaluated, and according to the risk level and preset security rules, a network isolation strategy is configured to obtain a preliminary isolation area setting;

[0029] Based on the preliminary isolation area settings, network isolation measures are deployed, including virtual private networks and access control lists, and isolation area settings are generated.

[0030] Preferably, the steps of obtaining the network environment monitoring result are:

[0031] Based on the isolation area setting, real-time data transmission rate, host access log, protocol type distribution and port connection status in the isolation area are collected to obtain isolation area monitoring data;

[0032] According to the monitoring data of the isolation area, the abnormal activity score in the isolation area is calculated, and the calculation formula is:

[0033]

[0034] in, Represents the score of abnormal activities in the isolated area. Representing the isolated area Traffic data in a time window, Represents the total number of time windows, Represents the number of time windows, Represents the time window Traffic data in a time window, Representative The duration of abnormal connection records, Represents the total number of abnormal connection records. Representative The number of connection attempts per host port, Represents the total number of all host ports, Represents the maximum number of connection attempts among all host ports;

[0035] Based on the abnormal activity score, the traffic pattern and connection behavior in the isolated area are analyzed, and the security status of the network environment is determined by combining the number of abnormal connections, packet type distribution and protocol change trends to generate network environment monitoring results.

[0036] Preferably, the steps for obtaining the comprehensive risk assessment results are:

[0037] According to the network environment monitoring results, the network risk factor is calculated, and the calculation formula is:

[0038]

[0039] in, is the network risk factor, Representative The number of abnormal access behaviors of users, Representative Number of visits by users, Represents the total number of users, Representative The number of abnormal packets in a time window, Represents the total number of time windows, Representative The number of abnormal resource usage of network devices, Represents the total number of monitored devices, Represents the score of abnormal activities in the isolated area;

[0040] Based on the network risk factors, the network security status is comprehensively evaluated to generate a comprehensive risk assessment result.

[0041] The present invention provides a safety protection system, comprising:

[0042] The network monitoring module collects user identity data, device security status data, access time data and network behavior data, and generates network behavior records;

[0043] The risk assessment module analyzes data based on network behavior records, makes security threat judgments for each user behavior, and generates security risk assessment results;

[0044] The identity authentication module, based on the security risk assessment results, applies a multi-factor authentication mechanism to verify the user's identity, confirm the legitimacy of the access, and obtain the user's identity authentication status;

[0045] The permission configuration module allocates dynamic network access rights based on user authentication status, user behavior and risk assessment, and generates dynamic access rights configuration;

[0046] The behavior monitoring module monitors and evaluates abnormal behaviors or potential threats in the network environment based on dynamic access permission configuration, isolates suspicious sources, and generates network environment monitoring results.

[0047] Compared with the prior art, the advantages and positive effects of the present invention are:

[0048] In the present invention, a dynamic security assessment system is constructed through network traffic monitoring, identity verification and behavior analysis, which can adapt to the ever-changing network attack environment compared to static strategies or fixed rule matching. Dynamic adjustment of permissions is performed based on the user's identity authentication status to ensure flexible management and control of access rights and avoid long-term high-authority abuse. Threat detection not only relies on historical pattern matching, but also combines real-time behavior analysis to perform precise isolation for potential threats, so that protection measures are transformed from passive response to active intervention, reducing the delay of manual intervention. Network environment monitoring integrates user behavior characteristics and environmental factors, comprehensively calculates risk scores, and reduces the problem of misjudgment caused by a single monitoring method. Risk assessment optimizes security strategies based on multi-layer data fusion, so that security protection has dynamic adaptability and reduces the concealment of new attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a schematic diagram of the steps of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0051] See also Figure 1 The present invention provides a technical solution, a computer network big data security protection method, comprising the following steps:

[0052] Conduct network traffic monitoring, collect user identity, device security status, access time, and network behavior data, and generate network behavior records; conduct real-time analysis of network behavior records, identify potential security threats, and generate security risk assessment results;

[0053] Based on the security risk assessment results, a multi-factor authentication mechanism is applied to verify the user identity and access legitimacy, and obtain the user authentication status; based on the user authentication status, network access rights are dynamically allocated and dynamic access rights configuration is generated;

[0054] Based on the security risk assessment results, isolate the source of abnormal behavior or potential threats and generate isolation area settings; monitor the isolation area settings and generate network environment monitoring results;

[0055] Utilize the network environment monitoring results to evaluate environmental factors and user behavior, calculate risk factors, and generate comprehensive risk assessment results.

[0056] The steps to obtain network behavior records are as follows:

[0057] Conduct network traffic monitoring to collect user identity data, device security status, access time, and network behavior data to generate a preliminary data set;

[0058] Based on the preliminary data set, a network behavior record is created, and through record analysis and data collation, a network behavior record is generated.

[0059] Specifically, in order to grasp the specific network activities in each time period, first determine the capture frequency based on ten times per second and set a high traffic threshold. This threshold can be calculated based on the historical peak data of the past month, for example, and the average traffic in each minute segment during the daily peak period is added and then divided by the number of sampling times to obtain the initial benchmark value R. Then, based on R, a weighted increment of 15% is selected as security redundancy, and finally an example value of the high traffic threshold is obtained. During the execution process, the TCP / IP data packet flowing through the switch port is first read, and then the source address, destination address and protocol type are extracted from its header information. At the same time, the user identity and device security status reference table entered in advance are compared. The reference table can be adjusted by The device status information registered in the actual network environment is generated. When it is found that the timestamp of some data packets deviates significantly from the recorded normal access period, the corresponding data will be marked as suspicious and recorded in an additional exception list. The user's identity data will be called in conjunction with the intranet user database, for example, to compare whether the work number, MAC address or other unique identifier is within the valid range. When all the data have been checked separately, they will be aggregated and a time index will be added. At the same time, a numerical judgment will be made on the device security status. For example, the device integrity is set to a percentage system and 60 points is set as the minimum security score. Devices with scores below 60 will be marked as high-risk sources in subsequent analysis, and finally a preliminary data set is obtained.

[0060] On the basis of the existing preliminary data, a comparison list is first established, and each data record is checked against several pre-established valid intervals one by one. For example, the access time is fully covered from 0:00 to 24:00 every day, and the time period with possible errors is split with a precision of ten minutes as a step. If the timestamp distribution is found to be beyond this range, it is judged as abnormal access. For the device security status, a more refined interval division is used, such as setting a score from 0 to 10 for high risk, 11 to 50 for medium risk, and 51 to 100 for low risk. The score is weighted according to the device integrity or the number of abnormalities calculated previously. The user identity data is mapped according to the work number or unique identifier. The mapping table is accurately proofread. The mapping table can be retrieved from the actual network authentication system and matched with the collected access records. During the process, each record is checked to see whether there is any unregistered or repeated login failure. The network behavior data is aggregated and counted according to factors such as access protocol, port number and data packet length. If the proportion of connection requests appearing on certain ports exceeds the set numerical threshold Q, for example, the calculation of Q can refer to the average port request peak value of the previous month plus thirty times of security compensation, then these connection requests will be included in the list for in-depth review. After obtaining the corresponding structured information through this multi-dimensional analysis and collation, a complete network behavior record is formed.

[0061] The steps to obtain the security risk assessment results are as follows:

[0062] Based on network behavior records, identify abnormal access behaviors that do not conform to normal patterns and obtain abnormal access behavior data sets;

[0063] Based on the abnormal access behavior data set, the potential security threat score is calculated using the following formula:

[0064]

[0065] in, Score the security threat. Representative The magnitude of abnormal behavior, is the median of the magnitude of abnormal behavior, Representative The number of packets with abnormal access requests. Representative The latency of an abnormal access request, Representative The number of occurrences of abnormal behavior categories, is the total number of abnormal behavior data, is the number of abnormal access requests, is the number of abnormal behavior categories;

[0066] Based on the security threat score, the security risk level in the current network environment is judged and the security risk assessment results are generated.

[0067] Specifically, according to the network behavior record content obtained previously, the access time and device information provided in the record are first disassembled and extracted, and the elements such as IP address, access port, request protocol and user identification are separated to form a list to be compared. Then a fixed comparison table is introduced. The comparison table can be generated by the access mode statistics collected during the actual operation and maintenance process. The comparison table contains parameters such as the common access time distribution range, port usage rate, protocol occurrence frequency and user identity authority level. When comparing one by one, each access record is compared with each parameter. For example, the access time is compared with the time interval from 0:00 to 24:00 every day. At the same time, the port usage rate is verified with the average connection frequency obtained from the statistics of the past month. If a certain record If the port request volume in the access record exceeds the average connection frequency for more than ten times in the same time window, it will be marked as a potential anomaly and compared with the device security score range (for example, the security score range is 0 to 100, where 60 points and above are relatively safe and less than 40 points are high risk). If the device security score is less than 40, it will be marked as a high-risk source. In addition, when judging the user identity and authority level, refer to the corresponding list of work numbers and roles collected on site. If a user has multiple abnormal requests during non-working hours or on weekends, he or she will also be included in the potential anomaly. Through this multi-dimensional comparison, all access items that deviate from the normal pattern are eventually identified from the network behavior records and summarized as an abnormal access behavior data set.

[0068] The benefit of the formula is that it can incorporate the comprehensive factors of behavior amplitude deviation and access requests in the time dimension and quantity dimension into a unified evaluation, and correct the denominator based on the cumulative number of occurrences of abnormal behavior categories, thereby obtaining a security threat score that takes into account the behavior intensity, abnormal request characteristics and abnormal category distribution, which is used to quantitatively measure the potential risk level of the current network environment.

[0069] The steps for obtaining the parameters are as follows: first, retrieve the behavior intensity or amplitude index related to the target event in the abnormal access behavior data set. The behavior amplitude can be calculated comprehensively based on the request frequency initiated by the device, the number of data packets accumulated in a short period of time, and other indicators that may represent attack intentions. For example, when counting the access data in a segment, add up the number of requests within 5 minutes and compare it with the overall average number of requests. After calculating the deviation ratio, multiply it by the connection time to obtain the original data of the behavior amplitude. After sorting all the original data, correspond it to the specific behavior item. In this process, an upper limit of the score can be set. For example, when the number of connections exceeds 1000 every 5 minutes, it will be recorded as 80 points, and 5 points will be added for each additional 100 times, and finally the behavior amplitude record is obtained. For example, in an actual monitoring, an abnormal behavior connected 1600 times in 5 minutes, exceeding the benchmark of 1000 times, and an additional 30 points were added, so the behavior amplitude was 110 points.

[0070] The steps for obtaining the parameters are as follows: first, a sequence is formed according to all the behavior amplitude values ​​obtained previously, and the value in the middle position is selected as the median according to the sequence length. If the sequence length is an even number, the average of the two middle values ​​can be directly used to define it. In actual execution, the behavior amplitudes are first arranged in ascending order, and the one or two positions in the middle of the sequence are found, and then the average operation is performed to obtain the median M. For example, when the behavior amplitude sequence has an odd number of elements, and the 11th element after sorting is 92, then , if there is an even number of elements and the two middle values ​​are 90 and 92, then .

[0071] The parameter acquisition step is to directly obtain the number of data packets involved in each abnormal access request from the abnormal access behavior data set. The number of data packets can be converted from the number of sent and received bytes indicated in the record. For example, in an actual monitoring, when it is detected that an abnormal TCP connection corresponds to a data volume of 7000 bytes, it is converted into several data packets. If the size of each data packet is counted as 1000 bytes, it can be counted that this request involves 7 data packets, corresponding to .

[0072] The parameter acquisition step is to extract the request delay information from the abnormal access behavior data set, and take the difference between the request start time and the successful response time as the delay. In a specific monitoring, it can be calculated by the millisecond timestamp. For example, if the start time read from the record is 100ms and the completion time is 180ms, the difference of 80ms is recorded as Second.

[0073] The steps for obtaining parameters are to classify abnormal access behaviors, such as classifying large-scale scanning attacks, frequent connection attempts, suspicious data injection, and protocol violations, and to count the C value according to the number of occurrences of each category. If, during a monitoring, large-scale scanning attacks are found to occur 3 times, frequent connection attempts occur 10 times, and protocol violations occur 2 times, then the values ​​3, 10, and 2 are recorded in the corresponding positions. This classification dimension can be clarified through on-site experience or industry specifications. At the same time, during specific implementation, the time and location of all classifications must be recorded to keep the records consistent. For example, after a summary, , , .

[0074] Calculation process:

[0075] The first step is to calculate the numerator, where The part represents the overall deviation of all behavior amplitudes relative to the median. Based on the sample just obtained, if there is abnormal behaviors, corresponding to , , ,and , the calculation process is as follows:

[0076]

[0077]

[0078] Then add Items, such as Abnormal access requests, , , , , then we can calculate:

[0079]

[0080]

[0081]

[0082] So the numerator is:

[0083]

[0084] Step 2: Calculate the denominator , if the number of categories ,and , , ,but:

[0085]

[0086]

[0087]

[0088] Finally available The values ​​are as follows:

[0089]

[0090] The results show that when When , it indicates that the current abnormal access behavior is aggregated to a certain extent in terms of amplitude deviation, number of data packets, and number of occurrences of abnormal categories. The larger the value, the higher the security threat. If it exceeds 2, it can be regarded as an extremely high-risk state. A corresponding warning threshold can also be set. For example, 2 can be used as the highest level trigger point to distinguish between ordinary warnings and emergency alerts. When the result is between 1 and 2, it can be regarded as a moderate risk range.

[0091] Based on the existing security threat scoring results, the corresponding IP and time period information is read from each abnormal record in the network, and matched with the pre-arranged risk assessment standard. The risk assessment standard can be derived from the annual attack and defense drill records of the enterprise security department and the inspection of the equipment in the whole network. Several segment intervals will be set. For example, a security threat score below 0.8 is classified as low risk, 0.8 to 1.5 is classified as general risk, 1.5 to 2 is classified as medium risk, and more than 2 is classified as high risk. When the security threat score of each abnormal record is compared with these segment intervals, if it is found that the score of some records falls into the medium or high risk interval, then in the later The platform generates a risk statistics table, and lists the time period information corresponding to each abnormal record together with the possible threat type. For example, if high-risk records break out in a certain period of time, confirm whether the corresponding IP segment and device security score have been lower than the specified threshold for a long time. If its security score is less than 40 points and exceeds the preset traffic limit for many times in a short period of time, continue to subdivide its request behavior, such as counting the number of repeated requests within five minutes, and then comparing it with similar situations within a month. If the number has been more than three times higher than the average of the same type within a week, it will be recorded in the key tracking list. By confirming the list item by item, the final security risk assessment result can be obtained.

[0092] The steps to obtain the user authentication status are:

[0093] Based on the security risk assessment results, a multi-factor authentication mechanism is executed to obtain the user identity verification status;

[0094] According to the user's identity authentication status and the abnormalities in the network behavior records, the user's access behavior is analyzed to evaluate whether the behavior meets the preset legal standards and obtain the verification result;

[0095] Based on the verification result, user access rights are assigned, and the access rights configuration generation process is performed to obtain the user access rights configuration.

[0096] Specifically, based on the security risk assessment results obtained above, we first call each user's registration information from the internal database and check their mobile phone number and email address. We set password input, SMS dynamic verification code, email verification link and other elements as necessary fields for the multi-factor authentication process. During the execution process, we assign a separate verification sequence to each user and set a threshold for the number of attempts. For example, we set the maximum number of incorrect attempts to three. This value is obtained by analyzing the user login statistics and historical misoperation ratios in the past year. The specific calculation process can first count the number of incorrect password inputs encountered by all users when logging in, divide them by month and calculate the average number of errors per month. If the average value exceeds five times in a certain month, it is classified as abnormal. We collect data from normal months and take three times as is the final threshold. When a user enters an incorrect password or dynamic verification code three times in a row during the authentication process, the user's subsequent login attempts will be suspended and an additional verification mechanism will be triggered. For example, an additional verification link will be sent to the mailbox and the user will be required to complete the confirmation within fifteen minutes. The fifteen-minute time limit is calculated based on the real-time email processing speed carried by the server and the mainstream mailbox sending and receiving delays. The specific method is to first count the time taken by five test servers to process email requests at different time periods, and then calculate the weighted average after taking the sending and receiving delays of three hundred records respectively. This weighted average plus the buffered security redundancy is the sample value of fifteen minutes. If the user can successfully pass the link verification within the specified time, he or she will be identified as having passed the multi-factor authentication, thereby obtaining the user identity verification status.

[0097] According to the user identity authentication status obtained previously, the abnormal access in the network behavior record is compared with the user's pass status in the multi-factor authentication. If the user identity authentication status is valid and there are no multiple access failures or timeout operations in the network behavior record, the user's access behavior is considered to be basically normal. If it is found that the user has passed the multi-factor authentication but there are port scans or frequent repeated login requests within a similar time range, further evaluate whether the operation meets the specified legal standards. The legal standards can be formulated in advance according to the company's operation and maintenance policies, including the maximum acceptable number of access behaviors, the security range of access ports and other detailed items. For example, the maximum number of scans allowed in a short period of time is limited to no more than five times. These five times The setting is based on the common port detection frequencies counted by the enterprise operation and maintenance department in the past three months. The number of port detections of all normal users is first recorded and the average value is calculated to be three times. Taking into account possible temporary troubleshooting operations or resource search needs, an additional two scan margins are added to form a threshold of five times. In this way, when a user performs six or more port scans within half an hour, it is judged that the behavior is higher than the legal standard, and the record is marked as worthy of special investigation. At the same time, it is necessary to determine whether to immediately interrupt the session based on the user's identity authentication status. In this way, the process of analyzing the matching degree of each access record with multi-factor authentication is finally extracted from the network behavior record to obtain the user operation that meets or does not meet the legal standard and obtains the verification result.

[0098] Based on the verification results obtained above, the existing access rights classification scheme is used to assign permissions to each user. When executing permission configuration, first confirm whether the user's verification results meet the basic access threshold set by the company. If the user's verification results show that most of its access actions are within the legal range and the multi-factor authentication status is valid, then the user is granted the corresponding level of access rights. For example, read-only permissions, modification permissions, or management permissions can be specified through the access rights list. Each permission can be associated with the operation scope of the database table when it is actually enabled. If a user's verification results indicate that it has triggered abnormal access behavior multiple times or has too many abnormal requests in the last half hour, only restricted permissions will be granted or access will be directly denied. The operation scope corresponding to the restricted permissions must be specified in the permission configuration. It is clearly recorded in the document, for example, limiting the addition and deletion operations on core data tables. This limit value can be defined according to the key resource directory generated by the enterprise background. The directory divides all database tables into four levels according to sensitivity, and counts the frequency of sensitive information leakage discovered in the past year. Combined with the priority of business needs, the most sensitive table is marked as the highest level, and the more common but non-core data tables are marked as ordinary levels. When assigning permissions, the accessible level range is dynamically determined based on the user verification results. If the verification results show that the user has no abnormal records and is in a low-risk state, access to all ordinary-level database tables is allowed, while retaining write operations on core tables. Through this item-by-item assignment process, the access permission configuration generation process is finally executed to obtain the user access permission configuration.

[0099] The steps to obtain dynamic access permission configuration are:

[0100] Based on the user access permission configuration, the user access permission adaptation value is calculated using the following formula:

[0101]

[0102] Among them, P is the user access permission adaptation value, ZT is the effective duration of user identity authentication, I is the time deviation of user access, B is the security score of the device, ZC is the access frequency coefficient, ZD is the stability of user behavior, E is the current user access request frequency, F is the impact value of user violation behavior, and G is the security status coefficient of the user account;

[0103] Based on the user access permission adaptation value and combined with user access data, the access permission policy is dynamically adjusted to generate and apply dynamic access permission configuration.

[0104] Specifically, the benefit of the formula lies in that it integrates the access status and security status coefficients in the same framework for comprehensive evaluation through the combined operation of multiple quantitative indicators such as the effective duration of user identity authentication, access time deviation, and device security score. This evaluation can reflect the coupling relationship between user access frequency and behavioral stability. At the same time, it also introduces the square root of the product of the impact value of the violation and the account security status coefficient in the denominator, thereby achieving an amplified treatment of high-risk factors, which helps to flexibly obtain a dynamic balance between user access rights and risk prevention and control under a parameterized scoring system.

[0105] Steps to obtain ZT parameters:

[0106] ZT is the effective duration of user identity authentication, which is indicated by the system after the user successfully passes multi-factor authentication. The specific value can be obtained by automatically detecting the user's login retention time within a certain period. For example, the interval between the start time of each successful authentication and the timeout time of the token (such as SMS dynamic verification code or fingerprint verification record, etc.) is counted, and ZT is set according to its actual average value. If all login times and expiration times are collected within 90 days, the corresponding initial verification point can be subtracted from all records to obtain several effective duration entries, and then the average value is calculated and compared with the maximum and minimum values. After filtering out extreme anomalies, a reasonable range of ZT is obtained. For example, a user has 20 effective verification times counted in the past month, and these times total 600 minutes. The average time is calculated = 600 / 20 = 30 minutes. Converting 30 minutes into seconds can represent ZT = 1800.

[0107] Steps to obtain I parameters:

[0108] I is the time deviation of user access, which is obtained by the system analyzing the records of user access in various time periods within a day. First, it is necessary to select multiple time segments in the log, such as taking half an hour as the minimum granularity, and count the various operation requests of the user during this period, and compare the offset with the established target access period, and accumulate and summarize the absolute difference to obtain the overall deviation value. The specific unit of I can be minutes or seconds. In this way, it can be seen in which period the user's online operations are most frequent and the degree of deviation from routine work. For example, the user's operation records are collected within a time range, and it is found that the user often maintains a high access frequency in the early morning period. The daytime period of the same day is used as the standard, and the time difference between the two is taken as the basic deviation data. The value of I is obtained after statistics. When it is counted that the user's operation in the early morning accumulates 300 minutes in a week, and the difference with the daytime operation is 90 minutes, the difference is quantified to obtain I=210.

[0109] Steps to obtain B parameters:

[0110] B represents the security score of the device, which is scored by the background based on multiple information such as the device's firmware version, vulnerability patching record, port status, and network traffic anomaly ratio. During execution, the evaluation indicators involved are first converted into component values. For example, the timeliness of vulnerability patching can be recorded in the range of 0 to 30 points. If the current firmware version receives all security patches within the specified period, 30 points can be recorded. If there is a lag, 10 points or less will be deducted according to the lag time. The port status can be evaluated and scored based on whether the high-risk port is open. The network traffic anomaly ratio can be converted into a component value based on information such as the proportion of high-risk traffic packets over a period of time. Finally, all the scores are added together to get the total, and then normalized using the upper and lower limits of experience (for example, 0 to 100 points). For example, statistics show that all the missed scan results of a certain device within a month have passed and there are no serious vulnerabilities, most of the ports are normal application ports, and the proportion of high-risk traffic is less than 2% of the total traffic. All scores are added up to get 85 points, recorded as B=85.

[0111] Steps to obtain ZC parameters:

[0112] ZC is the access frequency coefficient, which is obtained by analyzing the number of requests submitted by users in a unit time and comparing it with the normal access frequency sampled by the system. The average request of normal users in a similar time window is first used as a benchmark, and the ratio of the actual number of user requests to the benchmark is calculated. Finally, ZC is quantified according to the multiple of the benchmark value. For example, the benchmark request volume is set to 100 times / minute. When the actual user request volume is 120 times / minute, the ratio = 120 / 100 = 1.2 is recorded as ZC = 1.2. If it is found that the user's instantaneous access exceeds the benchmark value too much, the value of ZC will be increased accordingly. The value can be stored between 0.5 and 5, and the upper and lower limits are determined based on historical statistics. For example, in a long period of monitoring, it is found that the normal access frequency is usually less than 200 times / minute. The system will set the maximum value of ZC to 5. In an actual operation, if the user request volume is counted to exceed the benchmark value by 50%, ZC will be taken as 1.5.

[0113] Steps to obtain ZD parameters:

[0114] ZD is the stability of user behavior, which needs to be evaluated in combination with the fluctuations in the user's recent operations. For example, take the past 30 days as an observation period, record the distribution of the duration of various key operations of the user every day, and count whether there are unconventional operations and the distribution of high-risk operations. Convert it into a score according to the predetermined quantitative rules, and get a score sequence for several days and calculate its standard deviation or variance. Compare the result with the average of the user's overall operations, and finally get an interval quantitative value. For example, the most stable behavior is assigned a value of 1.0, and the extremely abnormal behavior is assigned a value of 0.1. In such an interval, the larger the ZD, the more stable the behavior. For example, count the daily key operation records of the user in 30 days, and evaluate the stage with the smallest fluctuation to about 0.9. If the operation in a certain stage is very chaotic, it is evaluated to 0.3. After integrating data from multiple days, ZD=0.7.

[0115] Steps to obtain the E parameter:

[0116] E is the current user access request frequency. Unlike ZC, ZC focuses more on the ratio coefficient relative to the benchmark, while E directly records the absolute request frequency generated by the user in the current period. For example, in a monitoring period, the number of requests of the user is counted in minutes, and the real-time value is taken as E. When E is greater than 600 requests / minute, it can be considered that the access is too intensive. The setting of the threshold of 600 is based on the peak access data counted within a year. After multiple rounds of monitoring, it is determined that the peak of most business types within one minute will not exceed 600 times. For example, in an actual operation, the user generates 250 requests in the current minute, then E=250.

[0117] Steps to obtain the F parameter:

[0118] F is the impact value of the user's illegal behavior. Combined with the previous analysis of all abnormal actions of the user on the network, including port scanning, a large number of illegal requests, data injection and other unauthorized behaviors, the system will score each illegal action. The score can be determined according to the degree of harm. Then, various illegal actions are accumulated and converted to obtain a comprehensive value of F. For example, from the monitoring report within one month, the user has 3 port scans and 1 password brute force attempt. The port scan is scored 10 points and the password brute force attempt is scored 20 points. The comprehensive score = 3×10+1×20=50. Then according to , so 1.5 is taken as the final impact value F.

[0119] Steps to obtain G parameters:

[0120] G is the security status coefficient of the user account. The difference from F is that F focuses more on illegal actions, while G is used to judge the overall protection status of the account itself, including whether it is bound to two-factor verification, the frequency of recent password changes, the completeness of account security questions, and various aspects of scoring in network behavior analysis. The above factors will be quantified and summed up, and then mapped to the interval between 0 and 1. Assuming that the highest score is 100, it is mapped to 1.0. If an account only gets 80 points, it is converted to 0.8. For example, a user has activated email verification and SMS verification, and the completeness of the answer to the security question is 90 points. Combined with the fact that there has been no abnormal password reset for a period of time, a total score of 80 points is finally obtained, and the mapping is G=0.8.

[0121] Calculation process:

[0122] The first step is to input the values ​​of each parameter. Taking an example scene, ZT=1800, I=12600, B=85, ZC=1.2, ZD=0.7, E=250, F=1.5, G=0.8.

[0123] The second step is to calculate the molecular part first. ,in , ZC×ZD=1.2×0.7=0.84, B+0.84=85+0.84=85.84, multiplying these two items we get 10800×85.84=928992.

[0124] Step 3: Calculate the denominator , , , then E + the result = 250 + 1.0954 = 251.0954.

[0125] Step 4: Calculate the final P value: ;

[0126] The results show that when the P value is greater than 3,000, it can be determined that the current user permissions and access behaviors are highly matched. An interval can also be set in the system. When P>2,000, permissions are approved according to more relaxed rules. When P<1,000, strict control is required. Here, P=3,699.16 indicates that the user's access permission adaptation level is at a high level, and it is suitable to allocate a larger scope of operations or resource access permissions. If the P value drops significantly in other cases, a more cautious access restriction strategy can be adopted to deal with it.

[0127] Based on the user access permission adaptation value obtained above, it is necessary to further combine this value with the access data submitted by the user in a specific scenario for adjustment. During execution, the access address and request type are first read from the recent account operation sequence, and the request type is divided into two categories: read-write operation and read-only operation. Read-write operation is more sensitive and may require a higher adaptation value to be allowed to pass. At the same time, the user's security status coefficient is compared with the violation impact value again. If the violation impact value is detected as 1.5 or higher in the previous detection, it is combined with the adaptation value for judgment. When the adaptation value increases significantly but the violation impact value remains at a high level, the access policy is changed. Slightly adjusted to partial release, that is, audit-level access is given to the core database, and only reading is allowed but not deletion and modification. When it is confirmed that the adaptation value is too low, for example, less than 1,000, the access scope is reduced to the specified read-only database. If the adaptation value exceeds 3,000 and the violation impact value is less than 1, the read and write permissions are opened. In this process, the user's operable scope will be matched in sequence from the highest sensitivity to the lowest sensitivity according to the pre-defined key resource list. The priority number of each sensitive resource is used to judge that when the access permission meets the corresponding number, the resource can be opened. In this way, all matching processes are integrated and the final dynamic access permission configuration is completed.

[0128] The steps to obtain the isolation area settings are:

[0129] Based on the security risk assessment results, analyze network traffic and user behavior, identify abnormal behaviors and potential threat sources that do not comply with security policies, classify and record potential threat sources, and generate a list of potential threat sources;

[0130] Based on the list of potential threat sources, evaluate the risk level of each threat source, configure the network isolation policy according to the risk level and preset security rules, and obtain preliminary isolation area settings;

[0131] Based on the preliminary isolation area settings, deploy network isolation measures, including virtual private networks and access control lists, and generate isolation area settings.

[0132] Specifically, based on the security risk assessment results obtained previously, first retrieve the corresponding records of the access source IP and port from the network traffic analysis list and analyze the abnormal connection types item by item, and determine that the focus is on the source that submits a number of connection requests exceeding the benchmark value in a short period of time or the source with multiple access to restricted resources. The benchmark value can be calculated based on the average port connection data of the previous month. First, the connection frequency of all registered IP addresses is counted in units of half an hour, and the median value with a proportion of more than 90% is taken as the initial benchmark. Then, a fixed safety margin is added to form a threshold range for identifying excessive connections. For example, when the statistical results show that the connection frequency of most IPs is between 50 and 100 times within half an hour, the median value of 75 is taken as a reference and a margin of 25 times is added, and 100 times is set as the connection request threshold. Then, the records of port brute force scanning or abnormal protocol switching are screened in the user behavior data and classified as specific abnormal types. If the system detects that an IP repeatedly tries more than five different ports within ten minutes, it is considered a port scan. Signs. These five port scanning indicators are formulated in combination with internal operation and maintenance conditions and industry general threat identification standards. According to statistics, the number of ports scanned by most abnormal scans in the first two months was five or less. If there were more port scans, they would be identified as potential threats. On this basis, the user identity information should be further verified. When unauthorized users are found to be wandering around high-frequency ports or trying to access network nodes listed as key concerns, they will be marked as suspicious sources, and the port number and communication timestamp will be recorded. If a certain IP continues to have high-risk actions, the IP and its corresponding MAC address will be listed as high-risk sources. In addition, for objects that perform suspicious data injection, they should be summarized in combination with the message fields extracted from the packet capture log. If the field contains multiple executable instructions or obvious abnormal characters, this source will be placed in the possible threat list. After the above multi-dimensional judgment, all abnormal sources can be classified by risk type or number of occurrences, such as port scanning, illegal protocol switching, out-of-range access and other categories. Each category is centrally organized according to information such as the source IP, MAC address, and network area to which it belongs. After the organization is completed, a list of potential threat sources is generated.

[0133] Based on the list of potential threat sources obtained above, we first evaluate the risk level corresponding to each threat source item by item. During the evaluation process, we can select the cumulative number of anomalies triggered by each threat source within a month as its basic risk indicator, and compare it with the pre-established risk determination interval. For example, 0 to 3 anomalies are considered low risk, 4 to 10 are considered medium risk, and more than 10 are considered high risk. This interval is selected based on the distribution characteristics of the monthly cumulative number of anomalies with reference to the statistics of security incidents reported within the organization. After confirming the risk level of the threat source, we configure the network isolation strategy for it in combination with the established security rules. For example, we implement the most stringent isolation measures for high-risk sources, including blocking Cut off its two-way communication with the core server and only retain one-way connection with the low-sensitivity area. At the same time, when configuring the isolation policy, set up access quotas for medium-risk sources. For example, the maximum number of connections allowed within fifteen minutes is no more than three times. This limit is determined based on business needs and the access statistics report of the past three months. The common device maintenance connection volume is superimposed with the normal external access volume, and a safety margin is reserved to obtain the example value. For low-risk sources, the conventional security policy can be temporarily maintained. After all policies are determined, isolation levels are assigned to different risk levels. Finally, various port restrictions, firewall rules, and cross-subnet communication restrictions are combined to form a preliminary isolation area setting.

[0134] Based on the preliminary isolation area settings obtained above, it is necessary to apply the virtual private network structure division and access control list rules in the network to the specified isolation domain. When executing the deployment, first set up multi-layer protection segments between the core server and the external access network according to the network topology diagram, and set access policy details for each segment. For example, divide the system server and database cluster into a high-sensitivity area, and divide the mail service and file sharing service into another medium-sensitivity area, and place the external network traffic in a low-sensitivity area. At the same time, refer to the threat source list determined above to isolate the high-risk sources separately, and directly reject their cross-zone connection requests in the access control list. If the threat If the threat source is of medium risk, it will be restricted to access only specific ports or services. Regular permissions can be used for low-risk sources. During the process, the exit and routing policies of each isolation zone need to be checked one by one. For example, port audits are performed on all inbound and outbound traffic in highly sensitive areas, and high-speed connections that exceed the threshold are blocked. The threshold can refer to the previously set 100-connection benchmark. If it is found that the cumulative number of connections of a risk source exceeds 100 within one minute, stricter filtering conditions are automatically added. At this time, the source traffic can be redirected to a monitoring pool for re-detection. After this layered deployment, each virtual private network and access control rules are updated synchronously, and after integration, a new isolation area setting is obtained.

[0135] The steps to obtain network environment monitoring results are as follows:

[0136] Based on the isolation area settings, collect the real-time data transmission rate, host access log, protocol type distribution and port connection status in the isolation area to obtain the isolation area monitoring data;

[0137] According to the monitoring data of the isolated area, the abnormal activity score in the isolated area is calculated using the following formula:

[0138]

[0139] in, Represents the score of abnormal activities in the isolated area. Representing the isolated area Traffic data in a time window, Represents the total number of time windows, Represents the number of time windows, Represents the time window Traffic data in a time window, Representative The duration of abnormal connection records, Represents the total number of abnormal connection records. Representative The number of connection attempts per host port, Represents the total number of all host ports, Represents the maximum number of connection attempts among all host ports;

[0140] Based on the abnormal activity score, the traffic pattern and connection behavior in the isolated area are analyzed. Combined with the number of abnormal connections, packet type distribution and protocol change trends, the security status of the network environment is determined and the network environment monitoring results are generated.

[0141] Specifically, based on the basic content of the isolation area setting, the switching equipment and routing nodes of each network segment are first disassembled according to the isolation area topology information obtained above. In this process, it is necessary to clarify the address allocation, port opening and protocol stack type of all hosts in the isolation area, and integrate the real-time data transmission rate, access log, protocol type and port connection status of each host to form multi-dimensional monitoring items. For example, the data transmission rate can be set from 0Mbps to 10Gbps. If it is found that the upload or download rate of any host is close to or exceeds the upper limit of the range, it is additionally marked as an abnormal rate entry. This range is selected based on the daily business statistics of the entire network. The specific approach is to collect the average rate of each host in a half-hour interval in different time periods and screen the peak value. If it usually only reaches about 8Gbps at most, an additional margin of 10Gbps is reserved to determine the monitoring upper line. At the same time, the timestamp and access target of the host access log should be extracted and compared with the established list of legal access targets. If the host frequently connects to the unauthorized target address more than three times in a certain period of time, its access log is appended to the suspicious item. The threshold of three times here is It is summarized from the historical data of internal risk investigation of the enterprise. When statistics show that most hosts have only one connection error or unauthorized target access per day in a quarter, three times can be used as a more stringent identification standard. The distribution of protocol types is distinguished according to types such as TCP, UDP and ICMP, and statistics are made on whether the proportion of occurrence in a short period of time deviates from the preset range. For example, TCP usually accounts for 70% to 90% of all traffic. If the UDP of a host suddenly jumps to 80%, it is judged as abnormal after comparison with its previous statistics. At the same time, the target port of the UDP session should be recorded. The port connection status can be observed to see whether there are a large number of accesses to uncommon ports or repeated handshake failures to common ports within the specified monitoring interval. If a port is found to have continuous handshake failures for ten times, the value of ten times is obtained based on the average number of retries on the same port within half an hour plus a certain deviation, indicating that the host may perform improper operations on this port. According to the above multi-dimensional statistics and comparisons, the real-time rate, access log, protocol ratio and port connection status of multiple hosts in the isolation area are finally merged to form isolation area monitoring data.

[0142] The benefit of the formula is that it incorporates the degree of traffic fluctuation in the isolated area, the duration of abnormal connections, and the extreme value of port connection attempts into one scoring indicator, quantifies the degree of traffic outliers through cubic absolute deviation, and introduces the ratio of the maximum number of port connections to the total number of all port connections in the subsequent terms, so that the peak of abnormal connections has a greater impact on the overall score, thereby more accurately measuring the intensity of abnormal activities in the isolated area.

[0143] The steps to obtain the parameters are:

[0144] Tj is the traffic data of the jth time window in the isolation area. The time window can be selected as an interval of five minutes or a shorter granularity. The network monitoring system accumulates and records the upload and download traffic of each host in bytes, and then summarizes the traffic of all hosts in this interval and takes the average of the total as the traffic data of this window. For example, the upload and download statistics of ten hosts in the isolation area generate a total traffic of 1000MB in five minutes, then 1000MB / 300 seconds = 3.33MB / s is recorded as the traffic data of this window.

[0145] The steps to obtain the parameters are:

[0146] m is the total number of time windows. This parameter is determined by the monitoring cycle and granularity set when configuring monitoring. For example, if you choose to implement 24-hour continuous monitoring of the isolation area, with a window every five minutes, you can get 24×(60 / 5)=288 windows in a day, so m=288. If you choose a window every ten minutes or a monitoring cycle of 72 hours, the value of m will change. In any case, you need to first specify the monitoring period and window size in the system, and then multiply and divide them to get the total number of time windows m. For example, in a two-hour test monitoring, if the window granularity is three minutes, there are 120 / 3=40 windows, so m=40.

[0147] The steps to obtain the parameters are:

[0148] k is the number of time windows, usually used to calculate the overall mean of traffic data , its value may be the same as or different from m, depending on the depth of historical data backtracking. If you only need to average all windows in the current monitoring period, then k=m. If you want to quickly compare the current window with the previous k-1 windows, then k can be less than m. For example, in a rolling monitoring scenario, only the data of the most recent 8 windows are used for average calculation, then k=8.

[0149] The steps to obtain the parameters are:

[0150] Lp represents the duration of the pth abnormal connection record. When the monitoring system finds that a connection is marked as abnormal, it records the total duration from connection establishment to disconnection. The duration can be calculated by subtracting the timestamp of the connection request from the timestamp of the last data transmission completion. If an abnormal connection lasts for 200 seconds, it is recorded as Lp=200.

[0151] The steps to obtain the parameters are:

[0152] r is the total number of abnormal connection records, which is used to calculate the average duration of abnormal connections. To obtain it, you need to check the recognition results of abnormal connections in the monitoring system on that day or within a certain period of time. As long as the connection is marked as abnormal, its count is +1. Finally, all abnormal connections are summed up to get r. For example, in an eight-hour monitoring cycle, every time a connection is judged to be abnormal, the system writes an identification to the log. Finally, the number of identifications is counted to get the value of r. If 10 anomalies occur within eight hours, then r=10.

[0153] The steps to obtain the parameters are:

[0154] Uq is the number of connection attempts for the qth host port. It is a port access statistic for all hosts in the isolated area. During execution, all port information is first collected and summarized according to the host ID and port number, and the number of times each port is accessed during the monitoring period is recorded. For example, port 443 of a host is requested 500 times and port 80 is requested 300 times, then these two values ​​are recorded in the corresponding positions respectively. When there are multiple hosts, as long as the port numbers are the same, the hosts must be distinguished to ensure the independence of the statistics. This process needs to be matched according to the common port list during actual operation. If a port that is not in the common list appears, it is placed in an additional record item and still counted in the number of visits when statistics are performed. For example, in a half-hour monitoring, port 22 of a host is attempted to connect 100 times, port 443 is attempted to connect 400 times, and port 443 of another host is attempted to connect 350 times, which can be superimposed on the corresponding host port one by one to form a sequence of Uq.

[0155] The steps to obtain the parameters are:

[0156] fn represents the total number of all host ports and is used to calculate When counting the sum of the ports that may be enabled by all hosts in the isolated area, you need to first clarify how many hosts are in the area and which ports they have opened. You can get fn by adding up the total number of open ports. For example, if ports 22, 80, and 443 are open on one host and ports 445, 139, and 3389 are open on another host, then the two hosts have a total of 6 ports available, and fn=6.

[0157] The steps to obtain the parameters are:

[0158] It refers to the maximum number of connection attempts among all host ports. The maximum value can be selected from the Uq array obtained above. For example, if port 443 has 1000 connection attempts and other ports are less than 500, then .

[0159] Calculation process:

[0160] The first step is to calculate Get an average traffic value. Take a sample scenario as an example, take k=6, and assume that there are 6 windows with Ti of 100, 120, 130, 110, 105, and 115 respectively, in MB / s. Then:

[0161]

[0162]

[0163] The second step is to calculate the And accumulate, assuming that the current m=6, that is, only these 6 windows are monitored, then the difference between each window and the average value, and the sum of the cube can be illustrated as follows:

[0164]

[0165]

[0166]

[0167]

[0168]

[0169]

[0170] The sum of the above results = 2368.67+296.37+4630.96+36.97+578.09+4.66≈7915.72,

[0171] Divide by m=6:

[0172]

[0173]

[0174] Step 3: Calculate , first take r=2, L1=100 seconds, L2=200 seconds, then , , and set fn=4. If U1=500, U2=200, U3=100, U4=50, then , ,but:

[0175]

[0176]

[0177] Step 4: Add the first two parts together to get:

[0178]

[0179] The result shows that when S=124.56, it means that in the current monitoring period, the degree of traffic fluctuation and the concentration of abnormal connections are relatively high. If S is greater than 100, it can be regarded as entering a more serious abnormal activity area. If S is lower than 50, it can be considered that the current activity level is low and the system can maintain regular monitoring unchanged. When S continues to soar to above 200, a stricter review and protection strategy should be triggered immediately, which provides a quantitative measurement method for identifying potential attack behaviors in isolated areas.

[0180] After obtaining the abnormal activity score above, the traffic pattern and connection behavior in the isolated area are compared. It is necessary to first split the traffic structure of each monitoring window, count the number of packets and bytes of TCP, UDP, ICMP and other protocols respectively, and identify the proportion of various types of regular business from the captured packet types. For example, HTTP or HTTPS usually accounts for 60% to 80% of all traffic. If non-standard protocols or port mapping requests exceed the specified range, the specific connection duration can be extracted from the port distribution table and then matched with the category of abnormal connection. If some suspicious hosts have continuous half-open connections or a large number of repeated handshakes are not completed, the corresponding time series will be recorded and compared with the baseline data of the previous statistics. For example, the connection success rate in the same period is set at 80% to 95% as the normal range. If the connection success rate of a host is only 50%, it means that there are a large number of attempts but no connection is established. The next step is to check the protocol conversion and port jump times, such as retrieving the abnormal process from TCP to UDP and then back to TCP, and checking whether there are byte sequences consistent with known malicious instructions in the packet payload. When these abnormal features are found to be consistent with the high abnormal activity score, it is determined that the isolated area is in a higher risk state. Finally, the problems of different hosts in various protocols and port connections are sorted out to form a comprehensive security status conclusion, which is recorded in the network environment monitoring results.

[0181] The steps to obtain the comprehensive risk assessment results are:

[0182] According to the network environment monitoring results, the network risk factor is calculated using the following formula:

[0183]

[0184] in, is the network risk factor, Representative The number of abnormal access behaviors of users, Representative Number of visits by users, Represents the total number of users, Representative The number of abnormal packets in a time window, Represents the total number of time windows, Representative The number of abnormal resource usage of network devices, Represents the total number of monitored devices, Represents the score of abnormal activities in the isolated area;

[0185] Based on network risk factors, comprehensively evaluate the network security status and generate comprehensive risk assessment results.

[0186] Specifically, the benefit of the formula is that it incorporates abnormal behavior on the user side, overall access frequency, abnormal activity scores in isolated areas, and key abnormal information at each time window or device level into the same calculation system. The comprehensive threat volume is formed by accumulating user behavior and access numbers on the numerator and multiplying them by the abnormal activity score. On the denominator, the sum of the squares of the abnormal number of network device resource usage and the total number of abnormal data packets in the time window are used as the benchmark, combined with the square root operation to amplify high load or multi-point abnormal situations. In this way, a risk factor that takes into account both abnormal user behavior and the overall abnormal distribution of the network can be obtained, which is used to determine the overall risk level of the current network security status.

[0187] The steps to obtain the parameters are:

[0188] Representative The number of abnormal access behaviors of each user. When collecting, it is necessary to count the abnormal access records of all users one by one. These abnormal accesses may include port scanning, illegal data injection, unauthorized resource access, etc. Each occurrence is counted as the abnormal access behavior count of the corresponding user + 1, and finally the total number of abnormal accesses of the user in the monitoring period is accumulated. For example, in a seven-day monitoring period, if a user is detected to perform protocol port detection twice, unauthorized login attempt once, and generate suspicious data injection once within a specific time period, the number of abnormal access behaviors of the user is accumulated to 4 times, recorded as .

[0189] The steps to obtain the parameters are:

[0190] Representative The number of visits by a user is used to count the total number of visits initiated by the user to the system under normal or abnormal circumstances. The visits here can be HTTP requests, TCP connections, or other forms of resource calls, but they must be measured in a unified manner, such as counting a single successful connection or a single successful request. In specific implementation, the connection records in the server or log system can be integrated, and the same user name or work number can be aggregated and all successful requests can be counted. For example, if a user logs in to the company's intranet and accesses multiple application services a total of 300 times in one day, then his number can be counted as Recorded as 300.

[0191] The steps to obtain the parameters are:

[0192] Represents the total number of users, used to determine the cumulative range of the numerator when calculating the formula. When obtaining, the number of all users who have registered or actually used network resources in the current monitoring environment can be found. Regardless of whether the user has abnormal behavior, it must be included in the total number. For example, in a LAN environment, when the system maintenance department records 100 online users, then If it is a large network, it is necessary to further check the company's personnel information or user registration database to ensure the accuracy of fp. and The sequence subscripts of are in one-to-one correspondence. The data from the 1st user to the fpth user must be guaranteed to have no overlap or omission. For example, when the monitoring terminal shows that there are 120 online users, the final fp=120.

[0193] The steps to obtain the parameters are:

[0194] Representative The number of abnormal data packets in a time window. When collecting, you need to first divide the monitoring cycle into fixed time lengths, such as a window of ten minutes or a window of five minutes. Then, in each time period, further identify the captured network data packets and select the data packets marked as abnormal, including virus packets, deformed packets, unauthorized command request packets, etc., and add up their numbers and record them as the number of packets in the window. , for example, in the k=5th time window, all abnormal data packets total 300, then .

[0195] The steps to obtain the parameters are:

[0196] Represents the total number of time windows, indicating how many consecutive windows are divided and recorded in the entire monitoring cycle. When obtaining, it is necessary to combine the specific monitoring plan. For example, if you monitor for 24 hours and use 10 minutes as a window, you can get windows, so q=144. When numbering, it can be counted from 1 to 144. If it is divided into longer periods or different granularities, it will affect the value of q. For example, for 72 hours of continuous monitoring, a window of 30 minutes is used, then window.

[0197] The steps to obtain the parameters are:

[0198] Representative The number of resource usage anomalies of a network device. When a network device runs out of processing resources or has a CPU overload, the system will mark it as a resource usage anomaly and record the time and extent of the occurrence. If a device has multiple resource usage anomalies during the monitoring period, the number of each anomaly will be accumulated. For example, within one day, if the firewall device has two CPU peaks and the switch device has one memory shortage, then the resource usage anomaly will be accumulated three times and recorded as .

[0199] The steps to obtain the parameters are:

[0200] Represents the total number of monitored devices, that is, the number of hardware devices actually included in this monitoring system. When determining fr, it is necessary to count all devices that can output resource usage status, including switches, firewalls, routers, intrusion detection hosts, or other machines with health monitoring functions. If 20 devices meet the conditions after counting, then .

[0201] The steps to obtain the parameters are:

[0202] Represents the abnormal activity score within the isolated area, which is calculated from the previous step.

[0203] Calculation process:

[0204] The first step is to separate the molecular part Expand, take an example scenario as an example, fp=3 means there are 3 users, and they are , , , and S=124.56, then first Addition:

[0205] User 1: 4+200=204;

[0206] User 2: 2+250=252;

[0207] User 3: 5+100=105;

[0208] Add up these sums: 204+252+105=561, and then multiply by S=124.56:

[0209]

[0210] Step 2: Calculate the denominator Taking an example scenario, let q=2 represent 2 time windows, UD1=300, UD2=100 respectively, fr=2 represents 2 devices included in monitoring, UH1=3, UH2=5 respectively, sum of the squares of the UD part = 3002+1002=90000+10000=100000, sum of the squares of the UH part = 32+52=9+25=34, sum of the two = 100000+34=100034:

[0211]

[0212] The third step is to divide the numerator result by the denominator result to get the final F value:

[0213]

[0214] The result shows that when F≈220.86, the network risk factor is in a relatively high numerical range, indicating that the amount of abnormal user behavior and the total amount of access during this monitoring process are large, and the data packet anomalies and device resource anomalies within the time window lead to an increase in the overall risk. If F exceeds 200, it can be regarded as a serious risk level. If F is lower than 50, it can be judged as a relatively stable security state. The specific threshold can be set by the operation and maintenance security team based on past attack trends and real protection data. In the actual production environment, when F is greater than a certain warning value, suspicious users and devices should be further reviewed immediately, and the security protection level should be improved.

[0215] Based on the network risk factors obtained above, a comprehensive comparison is made from the abnormal access details on the user side to the load records at the device layer. First, the UB and UM values ​​of each user are broken down into more detailed behavior categories. For example, corresponding classifications are established for port scanning, repeated login failures, cross-regional access, etc., and their increments or frequencies are checked against the set five-day or seven-day average behavior benchmark. When a certain type of behavior exceeds twice the benchmark, it is marked as a high-frequency behavior worthy of attention. The two-fold benchmark can be determined by analyzing the data of the historical statistical period. Then, the abnormal number of device resource usage is associated, such as checking whether high-frequency connections are related to CPU surges or memory usage of specific devices. If the two do not appear synchronously, and the overlap in time series is higher than 80%, it is determined to be a correlation anomaly. This 80% threshold is also selected by the operation and maintenance department after a large number of equipment load logs are analyzed within a quarter. By retrieving the data packet records in the same time window, it can be confirmed whether the device is simultaneously carrying high-frequency access or cross-segment connections initiated by users. If it is found that most of the abnormal accesses point to the same database instance or shared service, another sub-risk will be added to the overall risk represented by the network risk factor, and the service will be listed as a key inspection target. Finally, all potential risk targets will be centrally integrated to form the final comprehensive risk assessment result.

[0216] The present invention provides a safety protection system, comprising:

[0217] The network monitoring module collects user identity data, device security status data, access time data and network behavior data, and generates network behavior records;

[0218] The risk assessment module analyzes data based on network behavior records, makes security threat judgments for each user behavior, and generates security risk assessment results;

[0219] The identity authentication module, based on the security risk assessment results, applies a multi-factor authentication mechanism to verify the user's identity, confirm the legitimacy of the access, and obtain the user's identity authentication status;

[0220] The permission configuration module allocates dynamic network access rights based on user authentication status, user behavior and risk assessment, and generates dynamic access rights configuration;

[0221] The behavior monitoring module monitors and evaluates abnormal behaviors or potential threats in the network environment based on dynamic access permission configuration, isolates suspicious sources, and generates network environment monitoring results.

[0222] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A computer network big data security protection method, characterized in that: The following steps are involved: Conduct network traffic monitoring, collect user identity, device security status, access time, and network behavior data, and generate network behavior records; Conduct real-time analysis on the network behavior records, identify potential security threats, and generate security risk assessment results; Based on the security risk assessment results, a multi-factor authentication mechanism is applied to verify the user identity and access legitimacy, and obtain the user identity authentication status; based on the user identity authentication status, network access rights are dynamically allocated and a dynamic access rights configuration is generated; Based on the security risk assessment results, the source of abnormal behavior or potential threat is isolated and an isolation area setting is generated; the isolation area setting is monitored and a network environment monitoring result is generated; The network environment monitoring results are used to evaluate environmental factors and user behaviors, calculate risk factors, and generate comprehensive risk assessment results.

2. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the network behavior record are as follows: Conduct network traffic monitoring to collect user identity data, device security status, access time, and network behavior data to generate a preliminary data set; Based on the preliminary data set, a network behavior record is created, and the network behavior record is generated through record analysis and data collation.

3. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the security risk assessment results are: Based on the network behavior records, identifying abnormal access behaviors that do not conform to normal patterns, and obtaining an abnormal access behavior data set; According to the abnormal access behavior data set, the potential security threat score is calculated using the following formula: in, Score the security threat. Representative The magnitude of abnormal behavior, is the median of the magnitude of abnormal behavior, Representative The number of packets with abnormal access requests. Representative The latency of an abnormal access request, Representative The number of occurrences of abnormal behavior categories, is the total number of abnormal behavior data, is the number of abnormal access requests, is the number of abnormal behavior categories; Based on the security threat score, the security risk level in the current network environment is determined, and a security risk assessment result is generated.

4. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the user identity authentication status are: Based on the security risk assessment result, a multi-factor authentication mechanism is executed to obtain a user identity authentication status; According to the user identity verification status, combined with the abnormal conditions in the network behavior records, the user's access behavior is analyzed to evaluate whether the behavior meets the preset legal standards and obtain the verification result; Based on the verification result, user access rights are allocated, and an access rights configuration generation process is performed to obtain user access rights configuration.

5. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the dynamic access rights configuration are: Based on the user access permission configuration, calculating the user access permission adaptation value; Based on the user access permission adaptation value and in combination with user access data, the access permission policy is dynamically adjusted to generate and apply a dynamic access permission configuration.

6. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the isolation area setting are: Based on the security risk assessment results, analyze network traffic and user behavior, identify abnormal behaviors and potential threat sources that do not comply with security policies, classify and record potential threat sources, and generate a list of potential threat sources; Based on the list of potential threat sources, the risk level of each threat source is evaluated, and according to the risk level and preset security rules, a network isolation strategy is configured to obtain a preliminary isolation area setting; Based on the preliminary isolation area settings, network isolation measures are deployed, including virtual private networks and access control lists, and isolation area settings are generated.

7. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the network environment monitoring result are: Based on the isolation area setting, real-time data transmission rate, host access log, protocol type distribution and port connection status in the isolation area are collected to obtain isolation area monitoring data; According to the monitoring data of the isolation area, the abnormal activity score in the isolation area is calculated, and the calculation formula is: in, Represents the score of abnormal activities in the isolated area. Representing the isolated area Traffic data in a time window, Represents the total number of time windows, Represents the number of time windows, Represents the time window Traffic data in a time window, Representative The duration of abnormal connection records, Represents the total number of abnormal connection records. Representative The number of connection attempts per host port, Represents the total number of all host ports, Represents the maximum number of connection attempts among all host ports; Based on the abnormal activity score, the traffic pattern and connection behavior in the isolated area are analyzed, and the security status of the network environment is determined by combining the number of abnormal connections, packet type distribution and protocol change trends to generate network environment monitoring results.

8. The computer network big data security protection method according to claim 1 is characterized in that: The steps for obtaining the comprehensive risk assessment results are: According to the network environment monitoring results, the network risk factor is calculated, and the calculation formula is: in, is the network risk factor, Representative The number of abnormal access behaviors of users, Representative Number of visits by users, Represents the total number of users, Representative The number of abnormal packets in a time window, Represents the total number of time windows, Representative The number of abnormal resource usage of network devices, Represents the total number of monitored devices, Represents the score of abnormal activities in the isolated area; Based on the network risk factors, the network security status is comprehensively evaluated to generate a comprehensive risk assessment result.

9. The security protection system of the computer network big data security protection method according to any one of claims 1 to 8, characterized in that: include: The network monitoring module collects user identity data, device security status data, access time data and network behavior data, and generates network behavior records; The risk assessment module analyzes data based on network behavior records, makes security threat judgments for each user behavior, and generates security risk assessment results; The identity authentication module, based on the security risk assessment results, applies a multi-factor authentication mechanism to verify the user's identity, confirm the legitimacy of the access, and obtain the user's identity authentication status; The permission configuration module allocates dynamic network access rights based on user authentication status, user behavior and risk assessment, and generates dynamic access rights configuration; The behavior monitoring module monitors and evaluates abnormal behaviors or potential threats in the network environment based on dynamic access permission configuration, isolates suspicious sources, and generates network environment monitoring results.

Images