Strong isolation abnormal data analysis method, system and device and storage medium

Abstract

The invention discloses a strong isolation abnormal data analysis method, system and device and a storage medium, and is applied to the field of computer security, and the method comprises the steps: obtaining the original behavior data of a strong isolation boundary through an acquisition end deployed by a bypass; analyzing the original behavior data to obtain effective behavior data; performing double layering on the effective behavior data in a multi-dimensional analysis mode to obtain structured data; performing spatial vector hybrid dimension packaging on the layered structured data to obtain standardized packaging data; and sending the standardized packaged data to a server for data exception analysis. According to the method, all behavior data passing through the strong isolation boundary can be comprehensively acquired, the problem of security threat omission caused by incomplete data monitoring in the prior art is effectively avoided, the integrity and accuracy of data monitoring are ensured, and potential security threats can be accurately identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, and in particular to a strong isolation exception data analysis method, system, device and storage medium. BACKGROUND

[0002] With the rapid development of information technology, the network environment is becoming increasingly complex, and strong isolation technology is widely used between networks of different security levels to protect core data security.

[0003] Strong isolation refers to a security boundary with strict data exchange restrictions and access control mechanisms built between different network areas. However, in systems using strong isolation technology, existing data monitoring can only obtain intercepted data, while ignoring unblocked data passing through the boundary, which may result in potential security threats being missed. In addition, existing data encapsulation and analysis often lack unified standards and multi-dimensional comprehensive consideration, making it difficult to effectively analyze and process security.

[0004] Therefore, how to realize accurate behavior data monitoring and control in a strong isolation environment and improve security protection capability has become a technical problem to be solved by those skilled in the art. SUMMARY

[0005] The present application provides a strong isolation exception data analysis method, system, device and storage medium to solve the problem of exception data monitoring and analysis in a strong isolation environment.

[0006] To solve the above technical problems, the present application provides a strong isolation exception data analysis method, comprising: An acquisition end deployed through a bypass obtains original behavior data of a strong isolation boundary.

[0007] The original behavior data is analyzed to obtain effective behavior data.

[0008] The effective behavior data is double-layered in a multi-dimensional analysis manner to obtain structured data.

[0009] The layered structured data is spatially vector mixed dimensionally encapsulated to obtain standardized encapsulated data.

[0010] The standardized encapsulated data is sent to a server for data exception analysis.

[0011] Further, the acquisition end deployed through a bypass obtains original behavior data of a strong isolation boundary, comprising: All traffic behavior data passing through the strong isolation boundary is obtained through bypass network traffic monitoring environment using network traffic capture technology.

[0012] The traffic behavior data is parsed to obtain original behavior data.

[0013] Furthermore, the parsing of the original behavior data to obtain valid behavior data includes: Key feature information is extracted from the original behavior data, and the key feature information includes network behavior information, user operation information and device status information.

[0014] The key feature information is cleaned to remove invalid data and obtain intermediate cleaned data.

[0015] The intermediate cleaned data is formatted to obtain valid behavior data.

[0016] Furthermore, the effective behavior data is double-stratified in a multi-dimensional analysis manner to obtain structured data, including: The effective behavior data is subjected to multi-dimensional analysis according to the time dimension, space dimension and behavior feature dimension to obtain multi-dimensional feature data.

[0017] The multi-dimensional feature data is double-stratified and the stratification results are structured to obtain structured data.

[0018] Furthermore, the multi-dimensional feature data is double-stratified and the stratification results are structured to obtain structured data, including: According to the network protocol stack layer, the multi-dimensional feature data is divided into physical layer data, data link layer data, network layer data, transport layer data and application layer data.

[0019] According to the type of data behavior subject, the multi-dimensional feature data is divided into user behavior data, device behavior data and system behavior data.

[0020] The layered data is integrated according to the preset format to obtain structured data.

[0021] Furthermore, the layered structured data is packaged in a space vector mixed dimension to obtain standardized packaged data, including: Dimension quantization is performed on the structured data to obtain multi-dimensional quantized data.

[0022] The multi-dimensional quantized data is converted into a spatial vector form and fused to form comprehensive vector data.

[0023] The comprehensive vector data is formatted and packaged to obtain standardized packaged data.

[0024] Furthermore, the sending of the standardized packaged data to the server for data anomaly analysis includes: The standardized encapsulated data is transmitted to the server via an encrypted communication channel.

[0025] The server parses the received standardized encapsulated data to restore the comprehensive vector information of the mixed dimensions of the spatial vector.

[0026] The intelligent monitoring module based on the server detects and analyzes the restored comprehensive vector information and generates a safety detection report based on the analysis results.

[0027] Another embodiment of the present invention provides a strong isolation abnormal data analysis system, including: The data acquisition module is used to obtain the original behavior data of the strong isolation boundary through the collection end deployed in the bypass.

[0028] The data analysis module is used to analyze the original behavior data to obtain valid behavior data.

[0029] The double-layer module is used to double-layer the effective behavior data in a multi-dimensional analysis manner to obtain structured data.

[0030] The hybrid encapsulation module is used to perform spatial vector hybrid dimension encapsulation on the layered structured data to obtain standardized encapsulated data.

[0031] The anomaly analysis module is used to send the standardized packaged data to the server for data anomaly analysis.

[0032] Yet another embodiment of the present invention provides a computer device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the above-described strong isolation abnormal data analysis method when executing the computer program.

[0033] Yet another embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the device containing the computer-readable storage medium executes the computer program, the method for analyzing abnormal data with strong isolation as described above is implemented.

[0034] Compared with the prior art, the embodiments of the present invention have the following advantages: By deploying a collection terminal in a bypassed manner, we can comprehensively capture all behavioral data that passes through the strong isolation boundary, including not only intercepted data but also compliantly transmitted data. This comprehensive data acquisition method effectively avoids the omission of security threats caused by incomplete data monitoring in existing technologies, ensuring the integrity and accuracy of data monitoring. Using a multi-dimensional analysis method, we quantify and analyze behavioral data across multiple dimensions, including time, space, and behavioral characteristics, to accurately identify potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flowchart of the steps of a method for analyzing strongly isolated abnormal data in one embodiment of the present invention; Figure 2 This is a structural block diagram of a strong isolation abnormal data analysis system in one embodiment of the present invention; Figure 3 A structural diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0037] In the description of this application, the terms "first," "second," "third," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first," "second," "third," etc. may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0038] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be a communication between the two components. The terms "vertical", "horizontal", "left", "right", "up", "down" and similar expressions used herein are for illustrative purposes only, and do not indicate or imply that the device or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0039] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meanings as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by those skilled in the art in specific circumstances.

[0040] An embodiment of the present invention provides a method for analyzing abnormal data with strong isolation. For details, see Figure 1 , Figure 1 The flowchart of the method for analyzing abnormal data with strong isolation in one embodiment of the present invention includes steps S11 to S15: S11. Obtain the original behavior data of the strong isolation boundary through the collection end deployed by the bypass.

[0041] In a strongly isolated environment, monitoring of network traffic is one of the key steps to achieve security protection. In order to ensure comprehensive monitoring of traffic passing through the strongly isolated boundary, this embodiment adopts a bypass deployment method. Bypass deployment refers to deploying the acquisition end in a bypass environment of the network, and through network traffic capture technology, such as port mirroring, traffic sniffing, etc., all traffic behavior data passing through the strongly isolated boundary is obtained in real time. The advantage of this deployment method is that it can fully capture data packets in the network without affecting the transmission of original network traffic. For example, through port mirroring technology, the traffic on the network device can be copied to the acquisition end, thereby realizing real-time monitoring of the traffic. This method can not only capture normal traffic data, but also detect abnormal traffic behavior, providing a rich data foundation for subsequent security analysis.

[0042] The acquired traffic behavior data is the original network data packet, which contains a wealth of information, such as source IP address, destination IP address, port number, protocol type, data length, etc. In order to extract key information from this data, the collection end uses a multi-protocol parsing engine to parse the traffic behavior data. This parsing engine supports a variety of common network protocols, such as TCP, UDP, IP, HTTP, FTP, etc., and can be compatible with customized protocols in strong isolation scenarios through dynamic loading of plug-ins. The parsing process not only extracts the basic information of the data packet, but also conducts an in-depth analysis of the content of the data packet to extract key data fields that reflect behavioral characteristics, such as operation timestamps, behavior subject identifiers (user ID, device MAC address, etc.), and operation types (such as add, query, modify, delete, etc.). Through this process, the collection end can convert the original traffic behavior data into structured raw behavior data, providing support for subsequent data processing and security analysis.

[0043] S12, parse the original behavior data to obtain valid behavior data.

[0044] In a strong isolation environment, the original behavior data is complex and diverse, covering various interactive behaviors in the network. In order to extract valuable information from these data, it is necessary to extract key feature information from the original behavior data. This process involves deep parsing of data packets to identify and extract key information that can reflect network behavior, user operation and device status.

[0045] Network behavior information includes the source address, destination address, transmission protocol, packet size, etc. of the data packet, which helps to understand the pattern and flow of network traffic.

[0046] User operation information involves user login behavior, operation request, accessed resources, etc. Through these information, the user's activity track can be traced.

[0047] Device status information includes the running state, connection state, data transmission frequency, etc. of the device, which helps to evaluate the health status and performance of the device.

[0048] The extracted key feature information contains valuable content, but may also be mixed with a large amount of invalid data. These invalid data may include incorrect data records, repeated data entries, irrelevant data fields, etc., which may interfere with subsequent data analysis and processing. Therefore, data cleaning is needed to remove these invalid data.

[0049] Specifically, the data cleaning process of the embodiment includes identifying and deleting duplicate records, correcting incorrect data, removing irrelevant fields, etc. Through these operations, noise in the data can be removed, useful information can be retained, and more pure and accurate intermediate cleaning data can be obtained. The intermediate cleaning data is the data that has been preliminarily processed, which removes impurities in the original data, but has not been further formatted and standardized.

[0050] Although the intermediate cleaning data has removed invalid data, its format is still not uniform, which will affect subsequent data processing and analysis. In order to ensure the consistency and operability of the data, it is necessary to perform formatting processing on the intermediate cleaning data. The formatting processing process includes converting the data to a uniform format, ensuring the structure and standardization of the data.

[0051] Specifically, the embodiment processes the data by rearranging the data fields, uniformly converting the data types, normalizing the data values, etc., including converting the timestamp to a uniform time format, converting the IP address to a uniform representation, converting the operation type to a predefined enumeration value, etc. The intermediate cleaning data is converted into valid behavior data.

[0052] S13. Double-stratify the effective behavior data in a multi-dimensional analysis manner to obtain structured data.

[0053] In a strongly isolated environment, effective behavioral data contains a wealth of information, which requires multi-dimensional analysis to fully tap its potential value. Multi-dimensional analysis is a systematic approach that analyzes data across multiple dimensions, including time, space, and behavioral characteristics, to more comprehensively understand the inherent laws and characteristics of the data. Specifically: Time dimension analysis focuses on the temporal characteristics of data, including the timestamp of data generation, the periodicity of the data, and the duration of the data. By analyzing the time dimension, we can identify temporal regularities in the data, such as whether certain operations occur frequently within a specific time period or whether there are periodic abnormal behaviors. This analysis helps identify time-related security threats, such as unusual logins during non-business hours.

[0054] Spatial dimension analysis focuses on the spatial characteristics of data, including its source and destination (such as IP address and geographic location), as well as the data's transmission path within the network. Spatial dimension analysis can identify patterns in data distribution, such as whether certain IP addresses frequently access core network resources or whether there are unusual cross-regional access behaviors. This analysis can help identify spatially relevant security threats, such as attempts by external IP addresses to access core database network segments.

[0055] Behavioral feature analysis focuses on the behavioral characteristics of data, including operation type (such as query, modification, and deletion), operation frequency, and operation impact. By analyzing behavioral feature dimensions, we can identify behavioral patterns in data, such as whether certain operations have high-risk characteristics or whether there are unusual operation sequences. This analysis helps identify behavior-related security threats, such as an unusual increase in the frequency of deletion operations.

[0056] Through the analysis of the above three dimensions, we can obtain multi-dimensional feature data, which can more comprehensively reflect the characteristics and laws of effective behavioral data and provide a basis for subsequent hierarchical processing and structuring.

[0057] After obtaining multi-dimensional feature data, in order to further improve the processability and analyzability of the data, it is necessary to perform dual layering processing on the data and structure the layering results. The dual layering process includes layering according to the network protocol stack layer and the data behavior subject type. The specific steps are as follows: The network protocol stack hierarchy is the basic framework of network communication. According to this framework, the multi-dimensional feature data can be layered to better understand the transmission process and characteristics of the data in the network. Specifically, according to the network protocol stack hierarchy, the multi-dimensional feature data is divided into physical layer data, data link layer data, network layer data, transport layer data, and application layer data.

[0058] The physical layer data includes transmission rate, signal strength, physical connection state, and other information. These data reflect the physical transmission characteristics of the network and are used to identify abnormal behaviors of the physical layer (such as signal interference, physical connection interruption, etc.).

[0059] The data link layer data includes MAC address, frame check sequence, link layer protocol type, and other information. These data reflect the transmission of data in the network link layer and are used to identify abnormal behaviors of the link layer (such as MAC address spoofing, frame check error, etc.).

[0060] The network layer data includes IP address, subnet mask, routing information, and other information. These data reflect the transmission path and network topology of the data in the network layer and are used to identify abnormal behaviors of the network layer (such as IP address forgery, routing tampering, etc.).

[0061] The transport layer data includes port number, sequence number, acknowledgment number, and other information. These data reflect the transmission status and protocol characteristics of the data in the transport layer and are used to identify abnormal behaviors of the transport layer (such as port scanning, SYN flood attack, etc.).

[0062] The application layer data includes specific application protocol fields, operation instructions, application layer load, and other information. These data reflect the specific operation behavior of users in the application layer and are used to identify abnormal behaviors of the application layer (such as SQL injection, cross-site scripting attack, etc.).

[0063] By layering the multi-dimensional feature data according to the network protocol stack hierarchy, complex data can be decomposed into feature data at different levels.

[0064] In addition to layering according to the network protocol stack hierarchy, the multi-dimensional feature data can also be layered according to the data behavior subject type. The data behavior subject type includes users, devices, and systems. Specifically, according to the data behavior subject type, the multi-dimensional feature data is divided into user behavior data, device behavior data, and system behavior data.

[0065] The user behavior data includes user account, login time, operation sequence, accessed resources, and other information. These data reflect the specific operation behavior of users in the network and are used to identify abnormal behaviors related to users (such as illegal login, unauthorized operation, etc.).

[0066] Device behavior data includes information such as device model, MAC address, connection status, and data transmission frequency. This data reflects the device's operating status and behavior patterns on the network and is used to identify abnormal device behavior (such as device intrusion and device failure).

[0067] System behavior data includes information such as service startup time, operating status, and service activation status. This data reflects the system's operating status and behavior patterns within the network and is used to identify abnormal system behavior (such as service interruptions and system configuration tampering).

[0068] By stratifying multi-dimensional feature data according to the type of data behavior subject, the data can be decomposed into feature data of different subjects, which is convenient for analysis and processing from different angles.

[0069] After completing the above dual stratification process, the resulting data has been categorized according to different levels and entities. This stratified data needs to be integrated according to a preset format to become structured data. Specifically, the preset format in this embodiment refers to a predefined data format that includes information such as the data field name, field type, and field length. By integrating the stratified data according to the preset format, data consistency and operability can be ensured.

[0070] In this embodiment, the data integration process includes operations such as rearranging data fields, converting data types to a unified format, and normalizing data values. This includes converting timestamps to a unified time format, converting IP addresses to a unified representation, and converting operation types to predefined enumeration values.

[0071] By performing the above structural processing on the hierarchical results, structured data is finally obtained.

[0072] S14. Perform spatial vector mixed dimension encapsulation on the layered structured data to obtain standardized encapsulated data.

[0073] In a strongly isolated environment, although structured data already has a certain format and structure, in order to further improve the analyzability and processability of the data, it is necessary to quantify the dimensions of these data. Dimensional quantization refers to converting the different dimensional features of the data into quantifiable numerical forms to facilitate subsequent mathematical processing and analysis. Specifically, for each dimensional feature in the structured data, such as time, space, and behavioral features, corresponding quantization methods need to be defined. In this embodiment, the time dimension is quantified by the numerical representation of the timestamp, the spatial dimension is quantified by the numerical representation of the IP address, and the behavioral feature dimension is quantified by the numerical representation of the operation type. Through these quantization methods, the various dimensional features in the structured data can be converted into multi-dimensional quantitative data, providing a basis for the subsequent spatial vector mixed dimensional encapsulation.

[0074] After obtaining the multi-dimensional quantitative data, in order to further improve the analyzability and processability of the data, it is necessary to convert these data into a spatial vector form and perform fusion processing. The spatial vector form is a mathematical model that can represent the multi-dimensional characteristics of data. By converting the multi-dimensional quantitative data into a spatial vector form, the different dimensional characteristics of the data can be integrated into a unified vector space. Specifically, the processing method of this embodiment is to define a spatial vector model and use the quantitative data of each dimension as a component of the vector to form a comprehensive vector. Specifically, the quantitative data of the time dimension is used as the first component of the vector, the quantitative data of the spatial dimension is used as the second component of the vector, the quantitative data of the behavioral feature dimension is used as the third component of the vector, and so on. In this way, the multi-dimensional quantitative data can be converted into comprehensive vector data.

[0075] After obtaining the integrated vector data, in order to further improve the data's transmissibility and processability, it is necessary to format and encapsulate the data. Format encapsulation refers to encapsulating data in a certain format to facilitate data storage, transmission, and processing. In this embodiment, a packaging format is first defined, and the integrated vector data is encapsulated in this format. The encapsulation format includes three parts: a data header, a data body, and a data tail. The data header contains meta-information such as the encapsulation version number, data length, and timestamp. The data body contains the specific content of the integrated vector data. The data tail contains a checksum based on a hash algorithm, which is used to verify the integrity of the data during transmission. Through this packaging format, the integrated vector data can be encapsulated into standardized encapsulated data so that it has a unified format and structure.

[0076] S15: Send the standardized packaged data to the server for data anomaly analysis.

[0077] In a strongly isolated environment, secure data transmission is crucial. To ensure the security and integrity of standardized encapsulated data during transmission, this embodiment uses an encrypted communication channel to transmit the data to the server. The encrypted communication channel encrypts the data using an encryption algorithm, ensuring that the data cannot be stolen or tampered with during transmission. Specifically, this embodiment uses encryption protocols such as SSL / TLS to establish a secure communication channel. During transmission, the data is encrypted and sent over the network to the server. After receiving the data, the server decrypts it and restores the original standardized encapsulated data.

[0078] After the server receives the standardized encapsulated data transmitted through the encrypted communication channel, it first needs to parse the data to restore the comprehensive vector information of the mixed dimensions of the spatial vector. The parsing process is the inverse process of the encapsulation process, and the various parts of the encapsulated data are decoded and restored through the parsing algorithm. Specifically, the server first parses the data header to obtain meta-information such as the encapsulation version number, data length, and timestamp, so as to correctly parse the data body. Then, the server decodes the data body according to the encapsulation format and restores the various components of the comprehensive vector, that is, the multi-dimensional quantitative data. Finally, the server verifies the tail of the data through a verification algorithm to ensure that the data has not been tampered with or damaged during transmission.

[0079] After reducing the spatial vector mixed dimension comprehensive vector information, the server uses its intelligent monitoring module to detect and analyze these data. The intelligent monitoring module described in this embodiment is an analysis tool based on advanced algorithms and models, which can perform deep analysis and anomaly detection on data. Specifically, the intelligent monitoring module uses machine learning algorithms, data mining techniques, etc. to analyze the comprehensive vector information and identify abnormal patterns and potential threats in the data. For example, through clustering analysis, abnormal clustering points in the data can be found, through classification algorithms, known threat types can be identified, and through association rule mining, abnormal associations between data can be found. Clustering analysis is an unsupervised learning method that divides data points into different clusters, so that the similarity of data points in the same cluster is high, and the similarity of data points between different clusters is low. In this embodiment, by calculating the center point of each cluster and the distance from the data point to the center point, it can be judged whether the data point belongs to an abnormal clustering point. For example, if a data point is more than a certain pre-set threshold distance from its nearest cluster center, it can be determined as an abnormal clustering point. Classification algorithms are a supervised learning method that divides data points into different categories. First, labeled training data needs to be collected, including normal data and known threat types. Then, use these training data to train the classification model, which will learn the mapping relationship between different features and threat types. In the detection phase, the data to be detected is input into the trained model, and the model will output the category to which the data point belongs, thereby realizing the identification of known threat types. Association rule mining is used to find the relationship or association between data items. In this embodiment, by setting parameters such as minimum support and minimum confidence, statistically significant association rules can be filtered out. For example, if the support and confidence of the rule "X→Y" meet the pre-set threshold, and Y represents an abnormal event, then when X appears, it can be considered that there is an abnormal association, thereby triggering the anomaly detection mechanism.

[0080] Specifically, the abnormal situations obtained by data detection and analysis in this embodiment include abnormal behavior patterns, spatial anomalies, behavior feature anomalies, and association anomalies, etc.

[0081] For example, abnormal behavior patterns include time anomalies: detected behavior that does not conform to normal patterns, such as performing a large number of operations during non-business hours; frequency anomalies: detected behavior with a frequency exceeding the normal range, such as multiple failed login attempts within a short period of time; periodic anomalies: detected behavior that does not conform to normal periodic patterns, such as a user frequently performing high-risk operations at fixed times. Spatial anomalies include IP address anomalies: detected behavior involving unusual IP addresses, such as IP addresses from high-risk areas; network path anomalies: detected behavior that does not conform to normal patterns in network paths, such as data traffic that unusually bypasses certain network nodes. Behavioral feature anomalies include operation type anomalies: detected behavior involving unusual operation types, such as illegal file access or modification operations; user behavior anomalies: detected behavior that does not conform to normal user behavior patterns, such as a user suddenly attempting to access unauthorized resources. Association anomalies include user association anomalies: detected behavior involving unusual associations between multiple users, such as multiple users performing high-risk operations simultaneously; and system association anomalies: detected behavior involving unusual associations between multiple system components, such as multiple services experiencing abnormal conditions simultaneously.

[0082] The specific potential threat types detected include intrusion detection: what is detected may be external intrusion behavior, such as hacker attacks; internal threats: what is detected may be malicious behavior of internal users, such as data leakage; malware: what is detected may be malware activities, such as Trojans or viruses; network attacks: what is detected may be network attack behaviors, such as DDoS attacks, etc.

[0083] Based on these analysis results, the server generates a security detection report that records detected anomalies, potential threats, risk levels, and other information, thereby providing important reference for network security managers and clear guidance for subsequent security disposal, helping to promptly discover and handle network security issues and ensure network security in a strongly isolated environment.

[0084] Preferably, in order to further maximize the value of standardized encapsulated data in a strongly isolated environment, this embodiment continues to maintain collaborative linkage with the client after the server completes the exception analysis, and introduces visualization presentation, sensitive information protection, and dynamic policy adjustment mechanisms. The above mechanisms are all based on the generated standardized encapsulated data and do not cause any backtracking or modification to the original process. The specific instructions are as follows: After restoring the mixed-dimensional information of the spatial vector, the server further constructs a three-dimensional feature model of the security space: with the time dimension as the horizontal axis, the spatial dimension as the vertical axis, and the behavioral feature dimension as the vertical axis, the abstract multi-dimensional data is mapped into three-dimensional coordinate points, and the risk level is indicated by color depth.

[0085] After receiving the security detection report returned by the server, the client dynamically adjusts the handling intensity based on the risk level and context fields (such as network load, business period identifier, and user level) in the report.

[0086] Business identification periods refer to time periods defined by business activity patterns, such as business hours (8:00 AM - 6:00 PM) and non-business hours (6:00 PM - 8:00 AM the following day). During business hours, business activity is typically more frequent, and security policies may be more relaxed to ensure normal business operations. During non-business hours, business activity is less frequent, and any abnormal behavior may require more stringent security checks.

[0087] User levels are categorized based on user permissions and roles, typically into standard users, intermediate users, and advanced users (such as administrators). Standard users typically have only basic access rights, intermediate users may have limited administrative privileges, and advanced users have comprehensive system management privileges. User level categorization is determined based on specific business needs and security policies. In practice, user responsibilities, department affiliation, and the strictness of identity verification procedures can be used to determine user levels.

[0088] (1) The three risk levels of high, medium, and low correspond to “immediate blocking, secondary verification, and recording only.”

[0089] (2) When the network load exceeds the preset threshold (given by the load field in the report), the “Medium Risk - Block” will be automatically downgraded to “Medium Risk - Warning”, and blocking will be executed again after the load is restored.

[0090] (3) The entire process is completed through the standard API interface. The interface parameters remain consistent with the original "Safety Inspection Report" format, and there is no need to modify the data structure.

[0091] Before completing the stratification and encapsulation at the collection end, perform format-preserving desensitization on the extracted key feature information, specifically including: (1) Only sensitive subfields such as ID card number, bank card number, password ciphertext, etc. in the "User Operation Information" or "Device Status Information" fields are encrypted with AES-256 or hashed with SHA-256.

[0092] (2) The length and data type after desensitization remain unchanged, ensuring that the encapsulation format, vector dimension and server-side parsing logic are not affected.

[0093] (3) The desensitization flag (1-byte flag) is written into the reserved field of the original data header, which can be skipped or decrypted on demand during server parsing.

[0094] Specifically, in the implementation process of the scheme of the embodiment, first, a preliminary judgment is made according to the risk level, and then further adjustment is made in combination with the context field (including network load, service time period identifier, user level, etc.). The specific logic is as follows: If the risk level is high, the blocking operation is immediately performed regardless of the context field, because high-risk situations require the most stringent security measures to prevent potential security threats. If the risk level is medium, more detailed adjustment needs to be made according to the context field. When the network load exceeds the preset threshold, the original blocking operation is downgraded to an alarm, because high load may affect the normal operation of the business, and the alarm can avoid unnecessary interruption to the business, while reminding the security personnel to pay attention. If the user level is high, such as an administrator or a user with high privileges, then in the case of medium risk, a secondary verification should be performed, because the operation of a high-privilege user may involve more sensitive systems or data, and additional verification steps are needed to ensure the legality of the operation. If the risk level is low, only recording is performed, and no further blocking or alarm measures are taken, because low-risk situations are generally considered to be normal business operations and do not require additional security intervention.

[0095] The server generates a security detection report at the same time, and constructs an undirected weighted graph using the restored multi-dimensional vector: the nodes are users / devices / systems, and the edge weight is determined by the cosine similarity of the vector and the risk score. Through lightweight graph neural network (GNN) inference, the "potential association link" is output as an optional additional field of the report; if the GNN module is not enabled, the report remains in the original format.

[0096] In order to more intuitively illustrate the application of the method of the embodiment in a real scenario, the following example of "Mr. Zhang completes a payment operation through the power payment system" is used to demonstrate the complete process from data collection to anomaly analysis to linkage disposal. This example is only used to help understanding, and does not limit the protection scope of the present application.

[0097] On November 15, 2024, at 10:20:35 (timestamp), Mr. Zhang used a home smart phone (device type) to initiate payment through a home broadband (source IP network segment type), with a source IP of 192.168.10.50, a home address of A province B city (source IP home address), and a request sent to the A zone core server (physical topology location) of the core business network segment (10.100.5.20, destination IP network segment level) of the payment backend.

[0098] The original data shows that Mr. Zhang's user ID is E00123, a regular user with real-name authentication (user level, real-name authentication status). This payment amount is 200 yuan, and it was an active payment (operation type). This user has made regular payments around the 15th of each month for the past three months (periodicity). This payment was made 25 days after the last payment (historical operation interval), and the payment record integrity for the past 12 months is 100% (historical payment record completeness). The amount deviates by +5% (amount deviation) from the average of the last three payments (190 yuan). He made two payments that month (operation frequency), during peak weekday hours (8:00 AM to 6:00 PM, business time label).

[0099] The terminal device is running Android 13 (device operating system), with no abnormal records in the past 30 days (device historical behavior). The request uses the POST method (HTTP request method), and the data packet is verified to be complete (data packet integrity).

[0100] After quantization across 20 dimensions, the data collection end uses a weight vector of [0.4, 0.6] for the time dimension. The spatial dimension integrates network regional risk [0.1, 0.2] and core domain weight [0.8]. The behavioral feature dimension is normalized to 0.2 for amount and 0.2 for frequency. The weighted fusion generates a spatial vector of [0.42, 0.54] for encapsulation and transmission.

[0101] After analysis by the server, a multi-dimensional cross-analysis of features, including a fixed cycle, deviation from a normal amount, and the absence of abnormal device records, was used to determine the transaction was low risk (with a 92% confidence level). The client, with network load at 60% (below the critical threshold), executed the "allow transaction and log" procedure to ensure smooth and secure payment.

[0102] To intuitively demonstrate the improvement effect of this embodiment in a real strong isolation scenario, this embodiment compared this method with existing mainstream solutions on the same electricity payment dataset. The results are shown in Table 1: Table 1 The strong isolation anomaly data analysis method of the present invention can comprehensively capture all behavioral data that passes through the strong isolation boundary through a bypassed collection terminal, including not only intercepted data but also data transmitted in compliance. This comprehensive data acquisition method effectively avoids the problem of missing security threats caused by incomplete data monitoring in the existing technology, ensuring the integrity and accuracy of data monitoring. Using a multi-dimensional analysis method, behavioral data is quantified and analyzed in multiple dimensions such as time, space, and behavioral characteristics, which can accurately identify potential security threats.

[0103] The embodiment of the present invention further provides a strong isolation abnormal data analysis system for executing the strong isolation abnormal data analysis method described above. Figure 2 This is a structural block diagram of a strongly isolated abnormal data analysis system according to an embodiment of the present invention. The system includes: The data acquisition module 21 is used to acquire the original behavior data of the strong isolation boundary through the collection end deployed in the bypass.

[0104] The data analysis module 22 is used to analyze the original behavior data to obtain valid behavior data.

[0105] The dual stratification module 23 is used to perform dual stratification on the effective behavior data in a multi-dimensional analysis manner to obtain structured data.

[0106] The hybrid encapsulation module 24 is used to perform spatial vector hybrid dimension encapsulation on the layered structured data to obtain standardized encapsulated data.

[0107] The abnormality analysis module 25 is used to send the standardized packaged data to the server for data abnormality analysis.

[0108] The technical features and technical effects of the device proposed in the embodiment of the present invention are the same as those of the method proposed in the embodiment of the present invention and are not described in detail here. Each module in the above-mentioned device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software so that the processor can call and execute the operations corresponding to the above modules.

[0109] See also Figure 3 , which is a structural block diagram of a computer device provided by an embodiment of the present invention. The computer device provided by an embodiment of the present invention includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the steps in the embodiment of the strong isolation abnormal data analysis method are implemented, for example Figure 1 or, when the processor executes the computer program, the functions of the modules in the above-mentioned device embodiments are realized, such as the modules 21 to 25 of the strong isolation abnormal data analysis system.

[0110] For example, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules may be a series of computer program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0111] The computer device can include, but is not limited to, a processor, a memory. Those skilled in the art can understand that the schematic diagram is only an example of the computer device, and does not constitute a limitation on the computer device, and can include more or less components than the diagram, or combine certain components, or different components, for example, the computer device can also include an input / output device, a network access device, a bus, etc.

[0112] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The processor is the control center of the computer device, and connects various parts of the computer device through various interfaces and lines.

[0113] The memory can be used to store the computer program and / or modules, and the processor realizes various functions of the computer device by running or executing the computer program and / or modules stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function (such as a sound playing function, an image playing function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device or other volatile solid-state memory device.

[0114] If the module integrated into the computer device is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention can also implement all or part of the process steps in the above-mentioned method embodiments by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium.

[0115] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0116] Accordingly, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to perform the steps in the strong isolation abnormal data analysis method of the above embodiment, for example Figure 1 Steps S11 to S15 described in .

[0117] In summary, compared with the prior art, the embodiments of the present invention provide a method, system, computer device, and computer-readable storage medium for analyzing strongly isolated abnormal data. The beneficial effects of the embodiments of the present invention are at least one of the following: By deploying a collection terminal in a bypassed manner, we can comprehensively capture all behavioral data that passes through the strong isolation boundary, including not only intercepted data but also compliantly transmitted data. This comprehensive data acquisition method effectively avoids the omission of security threats caused by incomplete data monitoring in existing technologies, ensuring the integrity and accuracy of data monitoring. Using a multi-dimensional analysis method, we quantify and analyze behavioral data across multiple dimensions, including time, space, and behavioral characteristics, to accurately identify potential security threats.

[0118] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A strong isolation abnormal data analysis method, characterized in that: include: Obtain raw behavioral data within a strong isolation boundary through a collection terminal deployed in a bypass manner; Parsing the original behavior data to obtain valid behavior data; The effective behavioral data is double-stratified in a multi-dimensional analysis manner to obtain structured data; The layered structured data is packaged into mixed dimensions of spatial vectors to obtain standardized packaged data; The standardized packaged data is sent to the server for data anomaly analysis.

2. The strong isolation abnormal data analysis method according to claim 1, characterized in that: The bypass-deployed collection end obtains raw behavior data at the strong isolation boundary, including: Use network traffic capture technology to obtain all traffic behavior data passing through the strong isolation boundary by bypassing the network traffic monitoring environment; The traffic behavior data is parsed to obtain original behavior data.

3. The strong isolation abnormal data analysis method according to claim 1, characterized in that: The parsing of the original behavior data to obtain valid behavior data includes: Extract key feature information from the original behavior data, including network behavior information, user operation information, and device status information; Performing data cleaning on the key feature information to remove invalid data therein to obtain intermediate cleaned data; The intermediate cleaned data is formatted to obtain valid behavior data.

4. The strong isolation abnormal data analysis method according to claim 1, characterized in that: The effective behavior data is double-stratified in a multi-dimensional analysis manner to obtain structured data, including: Performing multi-dimensional analysis on the effective behavior data according to the time dimension, space dimension and behavior feature dimension to obtain multi-dimensional feature data; The multi-dimensional feature data is double-stratified and the stratification results are structured to obtain structured data.

5. The strong isolation abnormal data analysis method according to claim 4, characterized in that: The step of double-stratifying the multi-dimensional feature data and structuring the stratification results to obtain structured data includes: According to the network protocol stack layer, the multi-dimensional feature data is divided into physical layer data, data link layer data, network layer data, transport layer data and application layer data; According to the type of data behavior subject, the multi-dimensional feature data is divided into user behavior data, device behavior data and system behavior data; The layered data is integrated according to the preset format to obtain structured data.

6. The strong isolation abnormal data analysis method according to claim 1, characterized in that: The step of performing space vector mixed dimension encapsulation on the layered structured data to obtain standardized encapsulated data includes: Dimensionally quantizing the structured data to obtain multi-dimensional quantitative data; Converting the multi-dimensional quantized data into a spatial vector form and performing fusion processing to form comprehensive vector data; The comprehensive vector data is formatted and packaged to obtain standardized packaged data.

7. The strong isolation abnormal data analysis method according to claim 1, characterized in that: The sending of the standardized packaged data to the server for data anomaly analysis includes: Transmitting the standardized encapsulated data to the server via an encrypted communication channel; The server parses the received standardized encapsulated data to restore the comprehensive vector information of the mixed dimensions of the spatial vector; The intelligent monitoring module based on the server detects and analyzes the restored comprehensive vector information and generates a safety detection report based on the analysis results.

8. A strong isolation abnormal data analysis system, characterized by: include: The data acquisition module is used to obtain the original behavior data of the strong isolation boundary through the collection end deployed in the bypass; A data parsing module, configured to parse the original behavior data to obtain valid behavior data; A double-layering module is used to perform double-layering on the effective behavior data in a multi-dimensional analysis manner to obtain structured data; The hybrid encapsulation module is used to perform spatial vector hybrid dimension encapsulation on the layered structured data to obtain standardized encapsulated data; The anomaly analysis module is used to send the standardized packaged data to the server for data anomaly analysis.

9. A computer device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for analyzing strongly isolated abnormal data according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the strongly isolated abnormal data analysis method according to any one of claims 1 to 7 is implemented.

Images