Intelligent safety protection system based on big data

Abstract

The invention relates to the technical field of network security, in particular to an intelligent security protection system based on big data, which comprises an access path reconstruction module, an abnormal cross detection module, an instruction stacking monitoring module, a bandwidth resonance judgment module and a risk early warning output module. According to the method, the access abnormal path segment can be quickly positioned by dynamically identifying the jump frequency of the access log, the parameter fluctuation and the node behavior sequence, and the fine screening of the high-risk nodes in the behavior track is realized by combining the calling coincidence characteristics of the node operation resources and the abnormal time density. And further through conjoint analysis of an instruction nesting hierarchy and a parameter structure in a communication link, a stacking expansion trend and parameter abnormal variation in an instruction calling behavior are captured on a time sequence level, and the three-dimensional recognition capability of deep abnormal operation is enhanced. The change trend of the nested instruction and the network bandwidth utilization rate sequence are mapped, and the deep representation form of resource allocation imbalance is effectively captured.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an intelligent security protection system based on big data. Background Art

[0002] The field of network security technology includes technical means and methods to ensure the safe operation of computer network systems. Its core content includes monitoring and protecting the information transmission, data exchange and storage process in the network to prevent unauthorized access, data leakage, malicious attacks and system damage. Network security technology mainly involves identity authentication, access control, data encryption, security auditing, intrusion detection and defense, etc., and its application scope covers government affairs, finance, industrial control, personal privacy and other industries.

[0003] Among them, the intelligent security protection system refers to a software and hardware integrated solution for automatically identifying potential security threats and performing protection operations, which specifically covers technical matters such as feature analysis of access behavior, real-time monitoring of abnormal communications, feature identification of malicious code, analysis and determination of external device access behavior, etc. It is usually achieved through a policy-based access behavior determination rule set, a correlation matching method between behavior features and communication content, a multi-dimensional comparison method between code structure and dynamic behavior, and an anomaly identification method based on access features and historical patterns.

[0004] The existing intelligent security protection system relies on static rules and single-dimensional feature judgment in the process of behavior recognition. The processing granularity of abnormal jump frequency and parameter fluctuation of access behavior is insufficient, and it is difficult to identify micro-structure variations at the parameter level. The lack of a cross-dimensional linkage mechanism between access path jumps and operation resource calls makes it easy to miss high-coupling risk points when abnormal node behaviors intersect at multiple points. Instruction-level analysis is limited to the static comparison of a single call trajectory, and it is impossible to effectively mine the dynamic growth trend and abnormal evolution of parameter structure in nested instructions, making it difficult to discover hidden risks in deep operation chains. Under the existing mechanism, only surface statistics are made for bandwidth fluctuations, ignoring the potential coupling relationship with the instruction nesting level, and failing to effectively characterize the imbalance in resource allocation. For example, in the case where the attacker continues to call deep service instructions at a low frequency, causing the bandwidth to be gradually eroded, the system is prone to judge it as normal traffic because it does not associate the nesting level trend with the bandwidth sequence change, and misses the opportunity for intervention. In addition, the judgment of behavioral deviation at the policy response level does not form a joint comparison among behavioral paths, call frequency, and resource access, and lacks comprehensive recognition of complex behavioral patterns, which makes the system's real-time and accuracy in policy adjustment obviously insufficient. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an intelligent security protection system based on big data.

[0006] To achieve the above object, the present invention adopts the following technical solutions: An intelligent security protection system based on big data includes: The access path reconstruction module obtains access logs in the network environment, identifies the abnormal frequency of access jumps and parameter fluctuations, filters out the path segments with excessive jump times and abnormal parameters, and generates a set of path jump segments; The abnormal cross-detection module extracts the node numbers and corresponding operation resource parameters in the jump segments of the set of path jump segments, analyzes the distribution of nodes in the abnormal area and the coincidence degree of call characteristics, and generates cross-abnormal node data; The instruction stacking monitoring module calls the instruction nesting records in the communication link according to the node numbers in the cross-abnormal node data, analyzes the parameter structure, target address and callback times in the instruction call process, filters out the nodes with abnormal growth of instruction stacking, and generates a set of stacking abnormal characteristics; The bandwidth resonance discrimination module analyzes the correlation between the change of instruction stacking level and the fluctuation of bandwidth occupancy rate for the nodes in the set of stacking abnormal characteristics, filters out the nodes with bandwidth imbalance phenomenon, and obtains a set of bandwidth imbalance nodes; The risk warning output module analyzes the deviation of the current behavior characteristics of the nodes from the policy benchmark based on the set of bandwidth imbalance nodes, and executes corresponding adjustment operations to generate a dynamic security protection result.

[0007] As a further solution of the present invention, the set of path jump segments includes abnormal distribution of jump times, parameter feature deviation records, and node sequence positioning information. The cross-abnormal node data includes resource call coincidence identification, behavior frequency synchronization mark, and abnormal area mapping result. The set of stacking abnormal characteristics is specifically instruction nesting level information, call structure feature value, and node stacking offset situation. The set of bandwidth imbalance nodes specifically refers to bandwidth occupancy fluctuation records, path allocation imbalance identification, and node association relationship data. The dynamic security protection result includes permission adjustment records, instruction call limit parameters, and bandwidth allocation optimization configuration.

[0008] As a further solution of the present invention, the access path reconstruction module includes: The node extraction sub-module obtains the big data resources of access logs in the network environment, extracts access nodes, jump types, and request parameters, counts the occurrence frequency and jump type distribution of each access node, and generates node behavior feature data in combination with the quantity and type of request parameters; The jump detection sub-module detects non-adjacent jump behaviors in the access node sequence based on the node behavior feature data, counts the jump times and jump intervals of each node segment, calls the benchmark path record of normal access behavior, compares whether the jump times and jump intervals exceed the jump frequency benchmark interval, filters out the node segments with abnormal jumps, and obtains jump abnormal node data; The parameter comparison sub-module, based on the jump anomaly node data, counts the differences in the key names of the request parameters before and after the jump, the changes in the parameter value types, and the fluctuations in the parameter set size, calls the normal request parameter distribution data, compares whether the changes in the parameter characteristics exceed the parameter fluctuation benchmark range, filters out the node segments with excessive jump times and abnormal parameter characteristics, and generates a path jump segment set.

[0009] As a further solution of the present invention, the anomaly cross-detection module includes: The resource parameter association sub-module, based on the path jump segment set, extracts the node numbers of the jump segments and the corresponding operation resource parameters, detects whether the operation resource parameters appear in the abnormal behavior records of network security events, counts the abnormal association times of the node resource identifiers, calls the resource abnormal association benchmark value, filters out the nodes with abnormal association times exceeding the benchmark value, and generates resource association abnormal data; The abnormal area matching sub-module, according to the resource association abnormal data, extracts the operation time information of the corresponding nodes, counts the time distribution density of the nodes in the abnormal behavior records, calls the abnormal time distribution benchmark value, compares whether the time distribution density of the nodes is higher than the density benchmark value, filters out the nodes with time distribution density exceeding the density benchmark value, and obtains the abnormal area concentration data; The behavior feature comparison sub-module calls the abnormal area concentration data, extracts the resource call parameters of the corresponding nodes, counts the operation type consistency rate, the call time interval coincidence rate, and the resource identifier matching rate of the nodes, calls the behavior feature coincidence threshold, judges whether the three indicators exceed the threshold at the same time, filters out the nodes that coincide in both resource call characteristics and behavior frequencies, and generates cross-anomaly node data.

[0010] As a further solution of the present invention, the instruction stack monitoring module includes: The instruction record extraction sub-module, based on the cross-anomaly node data, extracts the corresponding node numbers, calls the instruction nesting records in the communication link, obtains the instruction call sequence and the nesting level information of each node, counts the instruction call times and the change interval of the nesting level, and generates instruction call sequence data; The parameter structure analysis sub-module, according to the instruction call sequence data, extracts the input parameter structure and the target address characteristics of each layer of instructions, counts the number of input parameter fields, the parameter type distribution, and the number of target address changes, calls the parameter structure benchmark range, judges whether the parameter quantity and the target address change are abnormal, filters out the nodes with abnormal parameter structures, and obtains the abnormal quantity of the parameter structure; The stack trend calculation sub-module calls the abnormal quantity of the parameter structure, analyzes the growth situation of the nesting level in the continuous call process, calculates the stack level growth rate of each node, calls the stack growth threshold, judges whether the growth rate exceeds the threshold, filters out the nodes with abnormal growth of the stack level, and generates a stack abnormal feature set.

[0011] As a further solution of the present invention, the bandwidth resonance discrimination module includes: The bandwidth usage record extraction sub-module obtains the upper limit of bandwidth allocation and the used traffic within the corresponding time period for the nodes in the stack anomaly feature set, calls the instruction nesting record to record the timestamp and node ID, aligns the timestamp and maps it to the sampling time point of the bandwidth record, matches the used traffic and allocated bandwidth through the corresponding node ID, and calculates the bandwidth occupancy rate for each time period as the bandwidth usage rate sequence of the current node; The hierarchical association relationship analysis sub-module pairs the nesting level of each instruction with the bandwidth usage rate at the same time point in a sequence alignment manner according to the bandwidth usage rate sequence and the nesting level change sequence of the nodes in the stack anomaly feature set, constructs a joint sequence in chronological order, calculates the difference between the nesting level growth rate and the bandwidth usage rate change amplitude within each window, screens the continuous decline section of the bandwidth occupancy rate, and generates the bandwidth decline amplitude analysis result; The imbalance node screening sub-module is based on the bandwidth decline amplitude and the nesting level growth rate in the bandwidth decline amplitude analysis result, compares whether the two conditions of continuous increase in the nesting level and continuous decrease in the bandwidth usage rate are satisfied in the same window for each node one by one, records the imbalance nodes in the comparison process, and generates a bandwidth imbalance node set.

[0012] As a further solution of the present invention, the risk warning output module includes: The feature integration sub-module integrates the call frequency, call object type, and duration fields recorded in the resource call log for each node based on the bandwidth imbalance node set, and performs joint pairing with the stack level in the instruction nesting record and the jump times field in the path record, classifies the resource call coincidence, instruction stack intensity, and path jump amplitude of the node within the same time period, and generates a multi-dimensional anomaly feature quantity; The policy deviation judgment sub-module calls the multi-dimensional anomaly feature quantity, performs field-level matching with the resource access permissions, instruction call frequency limits, and bandwidth allocation references in the security policy database, calculates the deviation degrees of the current behavior of the node in the dimensions of permissions, frequencies, and bandwidths compared with the policy benchmarks respectively, performs label marking and classification statistics on the policy fields with deviation degrees exceeding the set threshold, and obtains the policy deviation degree distribution result; The security parameter adjustment sub-module performs operation item mapping on the over-limit fields in sequence according to the nodes based on the policy deviation degree distribution result, executes the operation of lowering the corresponding access level for permission convergence, controls the instruction frequency to the maximum threshold within the set range, and adjusts the bandwidth configuration value of the current node to align with the policy reference value, records the node numbers of all successfully executed adjustment operations, and generates a dynamic security protection result.

[0013] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In the present invention, by dynamically identifying the jump frequency, parameter fluctuations, and node behavior sequences of access logs, the abnormal access path segments can be quickly located. Combining the call coincidence characteristics of node operation resources and the abnormal time density, the fine screening of high-risk nodes in the behavior trajectory is realized. Further, through the joint analysis of the instruction nesting level and parameter structure in the communication link, the stacking expansion trend and parameter abnormal variation in the instruction call behavior are captured at the time series level, enhancing the three-dimensional recognition ability of deep abnormal operations. Mapping the change trend of nested instructions to the network bandwidth usage rate sequence, a resonance mode of nested level growth and bandwidth usage decline is constructed to effectively capture the deep manifestation form of resource allocation imbalance. Based on the identification of abnormal nodes, multi-dimensional behavior parameters such as resource call frequency, instruction stacking intensity, and path jump amplitude are integrated. Through the behavior portrait deviating from the policy benchmark, dynamic response and real-time adjustment to high-risk behaviors are achieved. This process realizes a multi-dimensional collaborative discrimination mechanism among access, behavior, resources, and policies at different levels, significantly enhancing the depth restoration and early warning accuracy of potential security threats, improving the system's dynamic control ability over hidden and progressive security risks in complex network environments, and ensuring the accuracy of the overall system response and the self-adaptability of policy configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is the system flow chart of the present invention; Figure 2 is the flow chart of the access path reconstruction module of the present invention; Figure 3 is the flow chart of the abnormal cross-detection module of the present invention; Figure 4 is the flow chart of the instruction stacking monitoring module of the present invention; Figure 5 is the flow chart of the bandwidth resonance discrimination module of the present invention; Figure 6 is the flow chart of the risk early warning output module of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0015] In order to make the objectives, technical solutions, and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0016] In the description of the present invention, it should be understood that the orientation or positional relationship indicated by the terms "length", "width", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc. is based on the orientation or positional relationship shown in the drawings. It is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on the present invention. In addition, in the description of the present invention, the meaning of "a plurality of" is two or more, unless otherwise specifically defined.

[0017] Please refer to Figure 1 , an intelligent security protection system based on big data includes: The access path reconstruction module obtains the big data resources of access logs in the network environment, extracts access nodes, jump types, and request parameters. For the access node sequence, it detects the non-adjacent jump behavior of nodes during continuous access, counts the jump times and jump intervals of each node segment, calls the benchmark path record of normal access behavior, compares whether the jump times exceed the jump frequency interval in the benchmark path, further counts the key name differences, parameter value type changes, and parameter set scale fluctuations of the request parameters before and after the jump, calls the normal request parameter distribution data, and compares whether the parameter feature changes exceed the parameter fluctuation benchmark interval. It screens the node segments with excessive jump times and abnormal parameter features and generates a set of path jump segments; The abnormal cross-detection module extracts the node numbers and corresponding operation resource parameters in the jump segments of the path jump segment set, correlates with the big data abnormal behavior records in the network security events, detects the distribution of target nodes in the abnormal behavior concentration area, compares the resource call parameters of the jump nodes with the operation types, call time intervals, and resource identifiers of the nodes in the abnormal area, screens the nodes that coincide in both resource call characteristics and behavior frequencies, and generates cross-abnormal node data; The instruction stack monitoring module calls the instruction nesting records in the communication link according to the node numbers in the cross-abnormal node data, obtains the input parameter structure, target address characteristics, and callback times of the corresponding nodes, analyzes the change trend of the stack level during the instruction call process, identifies the abnormal nodes whose stack level growth exceeds the growth threshold during continuous calls, and generates a set of stack abnormal characteristics; The bandwidth resonance discrimination module obtains the records of network path bandwidth allocation and actual usage for the nodes in the stack abnormal characteristic set, analyzes the correlation between the change of the instruction stack level and the fluctuation of the bandwidth occupancy rate, determines whether there is an abnormal decrease in the bandwidth occupancy rate during the process of stack level increase, screens the nodes with bandwidth imbalance phenomenon, and obtains a set of bandwidth imbalance nodes; Based on the bandwidth imbalance node set, the risk warning output module integrates the big data of resource calls, instruction stacking features, and path jumping behaviors of nodes. For nodes with path anomalies, resource call overlaps, instruction stacking anomalies, and bandwidth imbalance features, it matches the security policy database in the big data, detects the resource access permissions, instruction call restrictions, and bandwidth allocation rules corresponding to the nodes, analyzes the deviation of the current behavior features of the nodes from the policy benchmark, performs operations such as permission convergence, instruction call frequency restriction, and bandwidth allocation adjustment, screens the nodes that have completed security adjustments, and generates dynamic security protection results; The path jump segment set includes abnormal distribution of jump times, parameter feature deviation records, and node sequence positioning information. The cross-abnormal node data includes resource call overlap identifiers, behavior frequency synchronization markers, and abnormal area mapping results. The stacked abnormal feature set specifically refers to instruction nesting level information, call structure feature values, and node stacking offset situations. The bandwidth imbalance node set specifically refers to bandwidth occupancy fluctuation records, path allocation imbalance identifiers, and node association relationship data. The dynamic security protection results include permission adjustment records, instruction call restriction parameters, and optimized bandwidth allocation configurations.

[0018] Please refer to Figure 2 , the access path reconstruction module includes: The node extraction sub-module obtains the big data resources of access logs in the network environment, extracts access nodes, jump types, and request parameters, counts the occurrence frequency of each access node and the distribution of jump types, and generates node behavior feature data in combination with the quantity and type of request parameters; First, collect the access log files at different times of each day, arrange the access records in the order of timestamps, and extract the access node identifier, jump type code, and request parameter list from each record. The access node identifier is used to distinguish different resource entrances, the jump type code reflects the user operation path, and the request parameter list includes the specific content and parameter values of the user request. For the extracted access node identifiers, count their occurrence frequencies within 24 hours. For example, node A appears 150 times in a day, node B appears 85 times, and node C appears 200 times. Through frequency statistics, the access hot spots can be initially identified. Subsequently, classify and count the jump type codes, dividing them into three categories: direct jump, indirect jump, and cross-domain jump, and calculate the distribution ratios of the corresponding jump types for each node. For example, in node A, the direct jump accounts for 60%, the indirect jump accounts for 30%, and the cross-domain jump accounts for 10%. Then, for the request parameter list, count the number of request parameters and the parameter type distribution for each node. The parameter types include strings, numerical types, boolean types, etc. For example, the average number of request parameters for node A is 5, and the type distribution is 60% for strings, 30% for numerical types, and 10% for boolean types. After completing the basic data statistics, combine the access frequency, jump type distribution, and request parameter characteristics to calculate the behavior characteristic interval for each node. The behavior characteristic interval is determined by setting frequency thresholds, jump ratio thresholds, and parameter quantity fluctuation thresholds. Among them, the frequency threshold is set at ±20% based on the standard deviation of the daily average access volume, the jump ratio threshold is set at ±15% of the average proportion of each type, and the parameter quantity fluctuation threshold is set at ±10% of the historical average. For example, the frequency threshold interval for node A is 120 to 180 times, the jump ratio threshold for direct jumps is 51% to 69%, and the parameter quantity fluctuation interval is 4.5 to 5.5 parameters. If the actual statistical value of a certain node exceeds the above interval, it is marked as a node with abnormal behavior characteristics. Finally, generate the node behavior characteristic data.

[0019] The jump detection sub-module, based on the node behavior characteristic data, detects non-adjacent jump behaviors in the access node sequence, counts the number of jumps and jump intervals for each node segment, calls the benchmark path record of normal access behaviors, compares whether the number of jumps and jump intervals exceed the jump frequency benchmark interval, and filters out the node segments with abnormal jumps to obtain the jump abnormal node data; First, call the generated node behavior feature data, extract the access frequency, jump type distribution, and parameter feature interval of each node, arrange the access node sequence in chronological order, and detect whether the adjacent node numbers in the node sequence are continuous. If the node numbers are discontinuous and the jump is not made according to the standard path jump rule, it is determined as a non-adjacent jump behavior. For example, if the standard path is node A - B - C - D, and it is detected that after node A, it directly jumps to node D, it is recorded as a non-adjacent jump. Count the number of jumps and jump intervals in each node segment. The number of jumps is the cumulative number of consecutive non-adjacent jumps, and the jump interval is the difference in the number of nodes between two jumps. For example, in the node segment A - D - C - F, there are two non-adjacent jumps, and the jump intervals are 3 and 2 respectively. Subsequently, call the benchmark path record of normal access behavior, which is statistically obtained based on historical normal access data. Set the benchmark interval for jump frequency as the daily average number of jumps ± 25% and the jump interval not exceeding 1.5 times the length of the standard path. For example, the benchmark jump count interval is 1 to 3 times, and the benchmark jump interval is not exceeding 3 nodes. Compare the detected number of jumps and jump intervals. If the number of jumps exceeds 3 times or the jump interval exceeds 3, it is determined that the node segment is a jump abnormal node segment. Screen the node segments that meet the conditions for marking, and finally obtain the jump abnormal node data.

[0020] The parameter comparison sub-module, based on the jump abnormal node data, counts the key name differences of the request parameters before and after the jump, the changes in the parameter value types, and the fluctuations in the parameter set size, calls the normal request parameter distribution data, compares whether the parameter feature changes exceed the parameter fluctuation benchmark interval, screens the node segments with excessive jump counts and abnormal parameter features, and generates a set of path jump segments; First, compare the request parameters before and after the jump by key name, calculate the quantity difference between the newly added key names and the missing key names. For example, if the parameter key names before the jump are {id, user, type, status} and after the jump are {id, user, level, mode}, then there are 2 key name differences. Then, compare the parameter value types, and count whether the parameter value types corresponding to the same key name have changed. For example, if "status" was a string type before the jump and becomes a numeric type after the jump, then record it as 1 type change. At the same time, count the total quantity change of the parameter sets before and after the jump. If the parameter quantity was 4 before the jump and 6 after the jump, then the fluctuation range is 50%. Subsequently, call the normal request parameter distribution data, and set the parameter fluctuation benchmark interval based on the key name difference rate, parameter type change rate, and parameter set scale volatility in historical normal access. Among them, the benchmark interval for the key name difference rate is set to not exceed 20%, the parameter type change rate does not exceed 10%, and the parameter set scale volatility does not exceed 15%. For example, in a jump, the detected key name difference rate is 50%, the type change rate is 25%, and the parameter set volatility is 50%, all of which exceed the corresponding benchmark intervals. It is determined that there are abnormal parameter characteristics in this jump segment. At the same time, combined with the jump count information in the jump anomaly node data, judge whether the jump count exceeds the limit. If the jump count exceeds the upper limit of the jump frequency benchmark interval, then further confirm that this node segment is a node segment with an excessive jump count and abnormal parameter characteristics. Finally, screen out all eligible node segments to generate a set of path jump segments.

[0021] Please refer to Figure 3 , the abnormal cross-detection module includes: Based on the set of path jump segments, the resource parameter association sub-module extracts the node numbers of the jump segments and the corresponding operation resource parameters, detects whether the operation resource parameters appear in the abnormal behavior records of network security events, counts the abnormal association times of the node resource identifiers, calls the resource abnormal association benchmark value, screens out the nodes with abnormal association times exceeding the benchmark value, and generates resource association abnormal data; Based on the set of path jump segments, extract the node numbers and corresponding operation resource parameters in each jump segment. The operation resource parameters include a resource identifier, an operation type, and a call time. The resource identifier is used to uniquely identify the object to be operated on in the network. The operation type describes the category of access or modification behavior, and the call time records the specific operation time point. For the extracted resource identifiers, check each one against the abnormal behavior records in the network security events to detect whether the resource identifier appears in the abnormal behavior records. If it appears, count it as one abnormal association. For example, if the resource identifier corresponding to node number N123 is R567 and it appears 3 times in the abnormal behavior records, then the number of abnormal associations for this node is 3 times. Count the resource abnormal association times of all nodes in turn. Subsequently, call the resource abnormal association baseline value, which is set according to the abnormal association frequency of resource calls in normal operations. Refer to the distribution of resource association times in normal operations in the most recent 30 days, and take the mean plus twice the standard deviation as the baseline value. Suppose the mean obtained by statistics is 1.5 times and the standard deviation is 0.8 times, then the baseline value is set to 1.5 + 2×0.8 = 3.1 times, and it is rounded to 3 times in actual applications. If the number of abnormal associations of a certain node is greater than 3 times, then it is determined as an abnormal node. Finally, screen out all nodes whose abnormal association times exceed the baseline value to generate resource association abnormal data.

[0022] The abnormal area matching sub-module extracts the operation time information of the corresponding nodes according to the resource association abnormal data, statistically calculates the time distribution density of the nodes in the abnormal behavior records, calls the abnormal time distribution baseline value, compares whether the time distribution density of the nodes is higher than the density baseline value, and screens out the nodes whose time distribution density exceeds the density baseline value to obtain the abnormal area concentration data; According to the resource association abnormal data, extract the corresponding operation timestamps of each node in the abnormal behavior records, sort the operations of each node in time sequence in turn, and statistically calculate the inter-segment distribution formed by all operations on the time line. Define the time interval between each pair of consecutive operations as , the operation frequency is n, and the total time span is , that is: , where and are the time (in hours) when the node appears for the last time and the first time respectively. Define the time distribution density value of this node as the distribution function after the average density superposition offset correction of all operation time pairs: , where : The time distribution density value, indicating the operation intensity of the node per unit time, with the unit of "times / hour"; : The overall operation frequency of the node, reflecting the average operation density during the entire active period; : Accumulate and sum all consecutive operation intervals, ranging from the 1st to the an interval; : the operation interval duration, with the unit of "hour"; : the minimum interval correction constant, to avoid the denominator approaching zero when the operation interval is extremely small, with a value of 0.01 hour to ensure the stability of formula calculation; : represents the averaging process of the operation interval part, normalizing the density of all intervals. The first item is the basic access frequency density, and the second item is the operation interval density, is the minimum interval constant, to avoid the denominator being zero, with a value of 0.01 hour. The units of all variables are unified as "times / hour". For example, node N789 appears 5 times in the abnormal behavior records, at the 1st, 3rd, 4th, 6th, and 7th hours respectively. Corresponding to ΔT_total = 6 hours, and ΔT_i are 2, 1, 2, 1 hour respectively. The calculation is as follows: The first item: , the second item: , the overall density value: . Then, set the abnormal time distribution reference value, establish a threshold based on the statistical results of the time distribution density of normal nodes. Collect the operation records of 100 normal nodes in the same network system, calculate the average time density mean value as 0.65 times / hour, and the standard deviation as 0.28 times / hour. Set the upper threshold according to the 3σ control principle as: , compare with the calculated density value of node N789, which is 1.577 times / hour. Since 1.577 > 1.49, it is determined that this node is an abnormal node in time distribution. After performing the above process on all nodes, filter out the nodes whose time distribution density values exceed the threshold to obtain the concentrated data in the abnormal area. The behavior feature comparison sub-module calls the concentrated data in the abnormal area, extracts the resource call parameters of the corresponding nodes, counts the consistency rate of node operation types, the coincidence rate of call time intervals, and the matching rate of resource identifiers, calls the behavior feature coincidence threshold, judges whether the three indicators exceed the threshold at the same time, filters out the nodes that coincide in both resource call features and behavior frequencies, and generates cross-abnormal node data; Call the data in the abnormal area, extract the resource call parameters of the corresponding nodes, and calculate the consistency rate of node operation types, the coincidence rate of call time intervals, and the matching rate of resource identifiers. The consistency rate of operation types is the ratio of the node operation type to the operation type in the abnormal behavior record. The coincidence rate of call time intervals is the ratio of the node call time interval to the time interval in the abnormal record. The matching rate of resource identifiers is the ratio of the node resource identifier to the resource identifier in the abnormal record. Calculate the three indicators respectively. For example, the consistency rate of operation types of node N123 is 85%, the coincidence rate of call time intervals is 75%, and the matching rate of resource identifiers is 90%. Call the behavior feature coincidence threshold, which is set as the maximum value of each indicator in normal operation plus a safety margin of 10%. Assume that the maximum consistency rate in normal operation is 60%, then the threshold is 66%. Determine whether all three indicators exceed 66%. If all are satisfied at the same time, it is determined that there is an abnormal coincidence in the resource call characteristics and behavior frequencies of this node. Screen the nodes that meet the conditions and generate cross-abnormal node data. Please refer to Figure 4 , the instruction stack monitoring module includes: Based on the cross-abnormal node data, the instruction record extraction sub-module extracts the corresponding node numbers, calls the instruction nesting records in the communication link, obtains the instruction call sequence and nesting level information of each node, and calculates the instruction call times and the change range of the nesting level to generate instruction call sequence data; First, the unique number of each node needs to be sequentially extracted from the cross-abnormal node set, and the number is retrieved node by node in the communication link data to locate all communication records that match the node number. During this process, the instruction identification code, parent-child call relationship identification, and timestamp information in each record need to be extracted and sorted. By judging the time sequence and parent identification matching relationship between the parent and child instructions, a complete call nesting tree structure is constructed. Then, the occurrence times and nesting level positions of each instruction node in the nesting tree are calculated, and the change trend of the level over time is analyzed through time series to divide the level fluctuation range within different time windows. For example, if the level of a certain node changes from 2 to 7 within a certain window, it is recorded as the interval [2, 7]. Such change intervals will be used as a reflection of call stability in the future. The above processing process is applied to the instruction link backtracking in the automated assembly system. For example, when extracting the controller with node ID R1223 in the robot arm control system, its historical instruction nesting chain is MOVE→CHECK→LOCK→ROTATE→GRAB→CHECK. Then a hierarchical structure with a nesting depth of 6 is constructed. By counting at each time point, the level sequence can be obtained as [1, 2, 3, 4, 5, 6], and its interval fluctuation is [1, 6]. The call times and the set of fluctuation intervals of all nodes will be finally recorded as instruction call sequence data. The parameter structure analysis sub-module extracts the input parameter structure and target address characteristics of each layer of instructions according to the instruction call sequence data, counts the number of input parameter fields, the distribution of parameter types, and the number of target address changes, calls the reference interval of the parameter structure, judges whether the number of parameters and the target address changes are abnormal, filters out the nodes with abnormal parameter structures, and obtains the abnormal quantity of the parameter structure; First, extract the input parameter information of each instruction layer by layer. The specific operation is to traverse each layer of instruction records and parse fields such as "param_count", "param_types", and "target_addr" in them. By analyzing these three types of fields, a complete input parameter structure feature array of each layer of instructions can be constructed. Subsequently, count the number of parameter fields of each instruction node and record its type distribution (such as integer type, floating-point type, string, etc.). Compare the number of changes in the "target_addr" field in each instruction record. If the target address switches more than 3 times in 10 consecutive records, it is considered that there is frequent change. Then call the set reference interval of the parameter structure. For example, for the MOV instruction in the industrial control system, the reference parameter number is set to 3±1, and the target address change not exceeding 2 times is normal. Compare the actual collected value with the reference value. For example, if the parameter number is 5 and the target address change is 4 times, then this node is determined to be an abnormal node, and its parameter structure is included in the abnormal quantity statistics. The abnormal quantity is defined as the number of abnormal structure entries per thousand instructions. For example, a total of 10,000 instructions are detected, and 345 abnormal structures are found, then the abnormal quantity is 345 / 10,000 = 0.0345, indicating that there is an obvious parameter structure fluctuation problem in this sampling segment. The stack trend calculation sub-module calls the abnormal quantity of the parameter structure, analyzes the growth of the nested levels in the continuous call process, calculates the growth rate of the stack level of each node, calls the stack growth threshold, judges whether the growth rate exceeds the threshold, filters out the nodes with abnormal stack level growth, and generates a set of abnormal stack characteristics; Call the abnormal quantity of the parameter structure and analyze the growth of the nested levels in the continuous call process. First, for the instruction call sequence of a certain node in the communication link, set the set of nested levels within a time window as , where each represents the nested level value of the th instruction, which is a positive integer representing its nested depth in the instruction tree structure. Denote the maximum level as , where represents the maximum value of the nested levels in the analysis window; , where represents the minimum value of the nested levels within this window. The change amount of the node stack level is defined as the difference between the two: , where represents the range of level changes, which is used to measure the degree of structural fluctuation. Subsequently, calculate the growth rate of the stack level , and its formula is: , where represents the total number of instructions in the current analysis window and is a positive integer; represents the average growth rate of the nesting level within the window. In sliding analysis, the window can move continuously to obtain multiple growth rate values. Let the total number of windows be , the maximum and minimum level values of the -th window are and respectively, the window span is , then the growth rate of this window is: , where represents the stacked growth rate of the -th window, and are the maximum and minimum nesting level values within this window respectively, is the number of instructions within this window. Further, taking the average of the growth rates of all windows, the average growth rate is: , where is the average growth rate; is the total number of windows; represents summing over all windows from 1 to . To determine whether there is abnormal stacking behavior, it is necessary to compare the growth rate with the historical threshold. The calculation method of the stacking growth threshold is as follows: , where represents the stacking growth judgment threshold; is the average value of the growth rates of historical normal nodes; is the standard deviation of the growth rate; is the adjustment coefficient. The setting basis of the adjustment coefficient is as follows: Downsample the non-abnormal nodes in the system under the training data to obtain their growth rate set , calculate its average value and standard deviation , and set the adjustment coefficient to based on the strategy of not exceeding 5% of the outlier statistics, that is, the growth rate of the nodes outside two standard deviations is determined as abnormal growth. If the actual business tolerance is different, it can be set in the following intervals: Set in the lightweight monitoring system, and set in the strict audit system. The specific value should be calibrated based on the fluctuation range tolerated by the actual scenario and the distribution density of historical data. If it is calculated that , then the -th window is considered an abnormal stacking window. For example, assume that the nesting level sequence of a certain node in a certain window is , then there is , , , substituting into the formula gives: , if the historical statistical result is , , and setting , then there is: , since , this window is determined to be a stacking abnormal growth window, and this node and window position are included in the stacking abnormal feature set. Please refer to Figure 5 , the bandwidth resonance discrimination module includes: The bandwidth usage record extraction sub-module obtains the upper limit of the bandwidth allocation of the network path where the node is located and the actual usage traffic within the corresponding time period for the nodes in the stacking abnormal feature set, calls the timestamp and node ID recorded in the instruction nesting record, aligns the timestamp and maps it to the sampling time point of the bandwidth record, matches its usage traffic and allocated bandwidth through the corresponding node ID, and calculates the bandwidth occupancy rate of each time period as the bandwidth usage rate sequence of the current node; For the nodes in the stacking abnormal feature set, obtain the bandwidth resource information of the node in the specified network path, correspond the node number to the path information in the network topology structure, obtain the upper limit value of the bandwidth allocation on its path, and call the node usage traffic value and the corresponding timestamp field recorded in the communication monitoring log at the minute granularity, perform sequence alignment processing by comparing the timestamp field in the instruction nesting record, match the timestamp of each instruction in the nesting record downward to the bandwidth record time point not greater than its time point, accurately match the bandwidth usage value at the current time point with the upper limit value of the bandwidth allocation recorded in its network configuration through the node number field in the instruction record, after completing the dual matching of time and node, calculate the bandwidth occupancy rate, and its formula is the current usage traffic divided by the bandwidth upper limit value, and the value range is 0, 1. For example, the bandwidth upper limit of node X320 at the time point of 08:00 is 100 Mbps, and the usage traffic is 60 Mbps, then the occupancy rate is 60 / 100 = 0.6. If it is recorded as 70 Mbps at 08:05, then it is 0.7, and so on. The bandwidth occupancy rate sequence of node X320 at multiple time points is [0.6, 0.7, 0.75, 0.68, 0.65]. Each value is obtained from the ratio of the usage amount to the upper limit bandwidth of the same node at different times, and the bandwidth usage rate sequence is constructed in turn. In a large-scale distributed processing system, after multiple nodes generate the bandwidth usage rate sequence in parallel, it can be used for subsequent stacking level impact judgment to generate the bandwidth usage rate sequence. The hierarchical association analysis sub-module pairs the nested level of each instruction with the bandwidth utilization rate at the same time point in the sequence alignment manner according to the bandwidth utilization rate sequence and the nested level change sequence of the nodes in the stack anomaly feature set, constructs a joint sequence in chronological order, calculates the difference between the growth rate of the nested level and the change amplitude of the bandwidth utilization rate within each window, filters out the continuous decline section of the bandwidth occupancy rate, and generates the bandwidth decline amplitude analysis result; According to the bandwidth utilization rate sequence and the nested level change sequence of the nodes in the stack anomaly feature set, the two sequences are jointly aligned with the time stamp as the primary key. The nested level value and the bandwidth utilization rate value of the node are extracted at each time point to construct a joint sequence pair. For example, the corresponding value of T1 is the nested level 3 and the bandwidth occupancy rate 0.75, T2 is 4 and 0.7, and so on, forming a structure of [(T1, 3, 0.75), (T2, 4, 0.7), (T3, 5, 0.65)]. For the above structure, calculate the growth rate value of the nested level and the change amplitude of the bandwidth occupancy rate within each window with a sliding window of length 3. The calculation method is to take the difference between the end value and the start value and then divide by the window span. For example, if the level increases from 3 to 5, the growth rate is (5 - 3) / 3 = 0.666, and if the occupancy rate decreases from 0.75 to 0.65, the change amplitude is (0.65 - 0.75) / 3 = -0.0333. Repeat the above process to obtain the bandwidth change trend of each window. If the negative change amplitude of the bandwidth occupancy rate appears in three or more consecutive windows and is less than -0.02 each time, then this continuous section is regarded as the bandwidth decline section, record its start and end time points and the amplitude value range. If the bandwidth value of a certain node continuously declines within 08:00 - 08:10, it is marked as a valid section, and the bandwidth decline amplitude analysis result is generated. Based on the bandwidth decline amplitude and the nested level growth rate in the bandwidth decline amplitude analysis result, the unbalanced node screening sub-module compares whether the two conditions of continuous increase in the nested level and continuous decrease in the bandwidth utilization rate are satisfied for each node in the same window one by one, records the unbalanced nodes in the comparison process, and generates the bandwidth unbalanced node set; Based on the bandwidth decline rate in the analysis result of the bandwidth decline and the growth rate of the nested level recorded in the stack anomaly feature set, call the above two sequences one by one according to the node number, and compare whether the two constraint conditions are satisfied simultaneously according to the time window: one is that the bandwidth utilization rate shows negative growth in three consecutive windows, and the change amplitude is less than the set bandwidth decline threshold each time. Here, it is set to 0.2, that is, a 20% utilization rate decline amplitude. For example, if the bandwidth drops from 0.75 to 0.55, that is, the amplitude is 0.2, it can be regarded as meeting the condition. The other is that the growth rate value of the nested level within the corresponding time window exceeds the growth rate reference value of 0.3. If the node meets the above two conditions, record the current node number and mark it as a bandwidth stack imbalance node. For example, in the section from 08:00 to 08:15, the bandwidth value of node X320 drops from 0.75 to 0.52, and the nested level increases from 3 to 7. The corresponding growth rate is (7 - 3) / 3 = 1.33, then it meets the double judgment conditions, mark this node as a valid imbalance point, and generate a bandwidth imbalance node set. Please refer to Figure 6 , the risk warning output module includes: Based on the bandwidth imbalance node set, the feature integration sub-module integrates the call frequency, call object type, and duration fields recorded for each node in the resource call log, and performs joint pairing with the stack level in the instruction nesting record and the jump count field in the path record, classifies the resource call coincidence, instruction stack intensity, and path jump amplitude of the node within the same time period, and generates multi-dimensional anomaly feature quantities; Extract multiple field information recorded for each node in the resource call log. First, call the resource call log, and sequentially read the node number field and its corresponding call frequency field, call object type field, and call duration field. After completing the extraction of the corresponding relationship between the fields, call the stack level information of this node in the instruction nesting record, and obtain the jump count field from the path record. Through the alignment operation of the node number and the timestamp, map the data in the three data sources to the unified time axis, compare the multiple field values within the same time period to complete the joint pairing. During the pairing process, take the time window as the unit, count the number of times the call object type repeats within this window for each node one by one, and calculate the resource call coincidence rate value. The calculation formula for the coincidence rate is: , where represents the resource call coincidence rate, is the number of times of calling the same resource object within the time window, is the total number of resource calls within this time window. If a node calls resources 10 times within a time window, and 7 of them are calls to the same type of resource, then the resource call coincidence rate of this node is , while counting the changes in the corresponding stack level values and recording the maximum level change amplitude as the stack strength index, and then counting the fluctuation range of the path jump times as the jump amplitude reference value. For example, if the stack level of node A rises from 2 to 6 within a certain time window, the stack change amplitude is 4, and the jump times increase from 4 to 9, then the jump amplitude is 5. Generate feature combinations for each node in the above manner, classify and organize them into three index value sequences: resource coincidence rate, stack change amplitude, and path jump amplitude, complete the construction of the multi-dimensional behavior state of the node, and obtain multi-dimensional abnormal feature quantities. The policy deviation judgment sub-module calls the multi-dimensional abnormal feature quantities, performs field-level matching with the resource access permissions, instruction call frequency limits, and bandwidth allocation references in the security policy database, calculates the deviation degrees of the current node's behavior in the dimensions of permissions, frequencies, and bandwidths compared with the policy benchmarks respectively, performs label marking and classification statistics on the policy fields with deviation degrees exceeding the set thresholds, and obtains the policy deviation degree distribution result; Match the corresponding fields in the security policy database by node, and successively perform field-level comparison on the resource access permission field, instruction call frequency limit field, and bandwidth allocation reference field. Compare the resource call coincidence rate in the abnormal feature quantity with the permission field respectively, calculate the difference and define it as the permission deviation degree value. Compare the instruction stack change amplitude with the frequency limit field and then calculate the frequency deviation degree value. The deviation between the bandwidth usage and the reference value is the bandwidth deviation degree value. The three deviation degrees uniformly adopt the following deviation degree calculation formula: , where represents the deviation degree of the corresponding policy field, is the abnormal feature value of the current node, is the reference standard value of the corresponding field in the security policy. For example, if the resource call coincidence rate of node B is 0.7, and the benchmark value of the permission allowable coincidence rate set by the policy is 0.5, then the permission deviation degree is: , if its stack strength is 4 and the corresponding frequency benchmark value is 3, then the frequency deviation degree is , if the bandwidth usage ratio is 0.65 and the reference bandwidth configuration is 0.75, then the bandwidth deviation degree is , where the setting basis of the deviation degree threshold is to count the deviation range of historical data of similar nodes in the policy database, calculate the deviation average value and standard deviation, set the permission deviation threshold to 0.3, the frequency deviation threshold to 0.25, and the bandwidth deviation threshold to 0.2. The selection standard is the average value plus 1.5 times the standard deviation. Do not adopt the fixed value setting method to avoid static failure. Mark the fields with deviation degrees exceeding the threshold and classify and count them according to the field type. Finally, merge the types and quantities of the deviation fields of each node to obtain the policy deviation degree distribution result. The security parameter adjustment sub-module operates item mapping on the over-limit fields in sequence according to the node based on the policy deviation distribution result, executes the access level reduction operation corresponding to permission convergence, controls the instruction frequency to the maximum threshold within the set range, aligns the bandwidth configuration value of the current node with the policy reference value, records the node numbers of all nodes where the adjustment operation is successfully executed, and generates the dynamic security protection result; According to the policy deviation distribution result, taking the node as the unit, sequentially read the corresponding over-limit field items, set the operation mapping rule to correspond the field type with the specific control item, execute the access level reduction operation on the node with the over-limit permission field, that is, set the permission level field to the original basic level minus one level, control the instruction call frequency field of the node with the over-limit frequency deviation field to the upper limit of this type in the policy table, directly replace the current configured bandwidth value of the node with the over-limit bandwidth deviation field with the reference recorded in the policy table, record the node numbers of all nodes that complete the above three types of operations, aggregate and mark them by node to generate a node set, and obtain the dynamic security protection result. The above are only the preferred embodiments of the present invention, and do not limit the present invention in other forms. Any person skilled in the art may use the technical content disclosed above to make changes or modifications into equivalent embodiments with equivalent changes and apply them to other fields. However, as long as it does not depart from the technical solution content of the present invention, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. An intelligent security protection system based on big data, characterized in that: The system comprises: The access path reconstruction module obtains access logs in the network environment, identifies abnormal access jump frequencies and parameter fluctuations, filters out path segments with excessive jump times and abnormal parameters, and generates a set of path jump segments; The abnormal intersection detection module extracts the node numbers and corresponding operation resource parameters in the jump segments of the path jump segment set, analyzes the distribution of nodes in the abnormal area and the overlap of call features, and generates cross abnormal node data; The instruction stack monitoring module calls the instruction nesting record in the communication link according to the node number in the cross abnormal node data, analyzes the parameter structure, target address and callback number in the instruction calling process, screens the nodes with abnormal instruction stack growth, and generates a stack abnormality feature set; The bandwidth resonance discrimination module analyzes the correlation between the instruction stack level change and the bandwidth occupancy rate fluctuation for the nodes in the stack abnormality feature set, selects the nodes with bandwidth imbalance, and obtains the bandwidth imbalance node set; The risk warning output module analyzes the deviation between the current behavior characteristics of the nodes and the policy benchmark based on the bandwidth imbalance node set, and performs corresponding adjustment operations to generate dynamic security protection results.

2. The intelligent safety protection system based on big data according to claim 1 is characterized in that: The path jump segment set includes abnormal distribution of jump times, parameter feature deviation records, and node sequence positioning information; the cross abnormal node data includes resource call overlap identification, behavior frequency synchronization mark, and abnormal area mapping results; the stacking abnormal feature set specifically includes instruction nesting level information, call structure feature values, and node stacking offset conditions; the bandwidth imbalance node set specifically refers to bandwidth occupancy fluctuation records, path allocation imbalance identification, and node association relationship data; the dynamic security protection results include permission adjustment records, instruction call restriction parameters, and bandwidth allocation optimization configuration.

3. The intelligent safety protection system based on big data according to claim 1 is characterized in that: The access path reconstruction module includes: The node extraction submodule obtains the big data resources of access logs in the network environment, extracts access nodes, jump types and request parameters, counts the frequency of occurrence of each access node and the distribution of jump types, and generates node behavior feature data based on the number and type of request parameters; The jump detection submodule detects non-adjacent jump behaviors in the access node sequence based on the node behavior feature data, counts the jump times and jump intervals of each node segment, calls the benchmark path record of normal access behaviors, compares whether the jump times and jump intervals exceed the jump frequency benchmark interval, screens node segments with abnormal jumps, and obtains abnormal jump node data; The parameter comparison submodule counts the key name differences, parameter value type changes and parameter set size fluctuations of the request parameters before and after the jump based on the abnormal jump node data, calls the normal request parameter distribution data, compares whether the parameter feature changes exceed the parameter fluctuation benchmark interval, filters out node segments with excessive jump times and abnormal parameter features, and generates a path jump segment set.

4. The intelligent safety protection system based on big data according to claim 3 is characterized in that: The abnormal intersection detection module includes: The resource parameter association submodule extracts the jump segment node number and the corresponding operation resource parameter based on the path jump segment set, detects whether the operation resource parameter appears in the abnormal behavior record of the network security event, counts the abnormal association times of the node resource identifier, calls the resource abnormal association benchmark value, screens the nodes whose abnormal association times exceed the benchmark value, and generates resource association abnormal data; The abnormal area matching submodule extracts the operation time information of the corresponding node according to the resource-associated abnormal data, counts the time distribution density of the node in the abnormal behavior record, calls the abnormal time distribution benchmark value, compares whether the time distribution density of the node is higher than the density benchmark value, and selects the nodes whose time distribution density exceeds the density benchmark value to obtain the abnormal area concentrated data; The behavior feature comparison submodule calls the concentrated data in the abnormal area, extracts the resource call parameters of the corresponding nodes, counts the node operation type consistency rate, call time interval overlap rate and resource identification matching rate, calls the behavior feature overlap threshold, determines whether the three indicators exceed the threshold at the same time, and screens the nodes that overlap in both resource call features and behavior frequency to generate cross-abnormal node data.

5. The intelligent safety protection system based on big data according to claim 4 is characterized in that: The instruction stack monitoring module includes: The instruction record extraction submodule extracts the corresponding node number based on the cross-abnormal node data, calls the instruction nesting record in the communication link, obtains the instruction call sequence and nesting level information of each node, counts the number of instruction calls and the nesting level change interval, and generates instruction call sequence data; The parameter structure parsing submodule extracts the input parameter structure and target address characteristics of each layer of instructions according to the instruction call sequence data, counts the number of input parameter fields, parameter type distribution and the number of target address changes, calls the parameter structure benchmark interval, determines whether the number of parameters and target address changes are abnormal, screens nodes with abnormal parameter structures, and obtains the parameter structure abnormality amount; The stacking trend calculation submodule calls the parameter structure abnormality, analyzes the growth of the nested levels during continuous calling, calculates the growth rate of the stacking level of each node, calls the stacking growth threshold, determines whether the growth rate exceeds the threshold, filters out nodes with abnormal stacking level growth, and generates a stacking abnormality feature set.

6. The intelligent safety protection system based on big data according to claim 5 is characterized in that: The bandwidth resonance discrimination module comprises: The bandwidth usage record extraction submodule obtains the bandwidth allocation upper limit of the network path where the node is located and the usage flow in the corresponding time period for the node in the stacking abnormal feature set, calls the timestamp and node ID recorded in the instruction nested record, aligns the timestamp and maps it to the sampling time point of the bandwidth record, matches the usage flow and the allocated bandwidth through the corresponding node ID, and calculates the bandwidth occupancy rate of each time period as the bandwidth usage rate sequence of the current node; The hierarchical association relationship analysis submodule uses a sequence alignment method to pair the nesting level of each instruction with the bandwidth usage rate at the same time point according to the bandwidth usage rate sequence and the nesting level change sequence of the nodes in the stack abnormality feature set, constructs a joint sequence in chronological order, calculates the difference between the nesting level growth rate and the bandwidth usage rate change range in each window, selects the continuous decrease section of the bandwidth occupancy rate, and generates the bandwidth decrease range analysis result; The imbalance node screening submodule compares the bandwidth decrease amplitude and the nesting level growth rate in the bandwidth decrease amplitude analysis result node by node to see whether the two satisfy the conditions of continuous increase in nesting level and continuous decrease in bandwidth usage rate in the same window, records the imbalance nodes in the comparison process, and generates a bandwidth imbalance node set.

7. The intelligent safety protection system based on big data according to claim 6 is characterized in that: The risk warning output module includes: The feature integration submodule integrates the call frequency, call object type and duration fields recorded in the resource call log of each node based on the bandwidth imbalance node set, and performs joint pairing with the stacking level in the instruction nesting record and the jump number field in the path record, and classifies the resource call overlap, instruction stacking intensity and path jump amplitude of the node in the same time period to generate a multi-dimensional abnormal feature quantity; The policy deviation judgment submodule calls the multi-dimensional abnormal feature quantity, performs field-level matching with the resource access rights, instruction call frequency limit and bandwidth allocation reference in the security policy database, calculates the deviation of the node's current behavior compared with the policy benchmark in terms of authority, frequency and bandwidth dimensions, performs label marking and classification statistics on the policy fields whose deviation exceeds the set threshold, and obtains the policy deviation distribution result; The security parameter adjustment submodule maps the operation items of the over-limit fields in order by node according to the policy deviation distribution result, executes the access level reduction operation corresponding to the authority convergence, controls the instruction frequency to the maximum threshold within the set range, adjusts the bandwidth configuration value of the current node to align with the policy reference value, records the node numbers of all successfully executed adjustment operations, and generates dynamic security protection results.

Images