Big data detection system and method based on information security

Abstract

The present invention discloses a big data detection system and method based on information security, comprising: a data acquisition module, a manual operation status acquisition module, a device information self-check module, a device risk feature extraction module and a device information security analysis module, wherein the data acquisition module is used to obtain status data of a user device being attacked by a virus within a first unit time; the manual operation status acquisition module obtains all operation records of the user on the device within the first unit time; the device information self-check module performs self-check on the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time to obtain corresponding self-check results; the device risk feature extraction module searches for script files running on the device at the current time, identifies existing viruses, extracts features of the existing viruses, and obtains risk feature results caused by the corresponding viruses to the device.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a big data detection system and method based on information security. Background Art

[0002] With the rapid development of computer technology, people are using computer technology more and more widely. Through computer technology, data statistics and processing can achieve effective data management, improve people's data processing efficiency, and save manpower and material resources. However, while computer technology brings convenience to people, it also poses certain threats to people's management data. When people use devices, they may be attacked by foreign viruses, which may successfully tamper with the data stored in the documents in the device, thus seriously threatening people's interests.

[0003] The current big data detection system based on information security simply monitors the traffic generated by data to achieve information security management, but it does not take into account the tampering of original files in the device by invading viruses. This method has a weak impact on traffic, but the damage caused is greater, causing more property losses to people.

[0004] In view of the above situation, we need a big data detection system and method based on information security. Summary of the invention

[0005] The purpose of the present invention is to provide a big data detection system and method based on information security to solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a big data detection system based on information security, comprising: a data acquisition module, a manual operation status acquisition module, an equipment information self-checking module, an equipment risk feature extraction module and an equipment information security analysis module,

[0007] The data collection module is used to obtain status data of the user device being attacked by a virus within a first unit time;

[0008] The manual operation status acquisition module acquires all operation records of the user on the device within a first unit time;

[0009] The device information self-check module performs self-check on the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time to obtain the corresponding self-check result;

[0010] The device risk feature extraction module searches for script files currently running on the device, identifies existing viruses, extracts features of the existing viruses, and obtains risk feature results caused by the corresponding viruses to the device;

[0011] The device information security analysis module obtains the collection results of the data collection module, the corresponding self-check results in the device information self-check module, and the risk feature results caused by the virus to the device in the device risk feature extraction module, and normalizes the obtained results to obtain the device information risk value, and rates the device security according to the obtained device information risk value.

[0012] The present invention realizes the monitoring of viruses that attack devices and their impact on documents in the device through the collaborative cooperation of various modules, and then comprehensively considers various factors to evaluate the security of the device. This method can accurately judge the security status of the device by combining the attacking virus situation and the impact on the documents in the device.

[0013] Furthermore, the data collection module obtains status data of the user device being attacked by a virus within the first unit time. The data obtained by the data collection module refers to the situation where the user device detects that it is attacked by a virus but successfully defends against it. Viruses that actually exist in the user device but cannot be killed are not included in the obtained data.

[0014] The status data of the user device being attacked by viruses in the first unit time includes the type of virus that attacks the device each time and the corresponding harm coefficient.

[0015] The types of viruses that attack devices include network viruses, file viruses and boot viruses.

[0016] Different types of viruses will damage different areas of a device and have different corresponding risk factors.

[0017] Network viruses damage executable files in the device network, file viruses damage files in the device, and boot viruses damage the boot sector of the device and the system boot sector of the hard disk.

[0018] The corresponding harm coefficients of different types of viruses are obtained through database matching.

[0019] The method for obtaining the corresponding harm coefficients of different types of viruses in the database includes the following steps:

[0020] S1-1, obtaining the speed at which various types of viruses that successfully invade a device damage the documents in the device in historical data, and recording the number of documents damaged by each virus of the hth virus type in the second unit time before the current time as vph;

[0021] S1-2, obtaining the information type contained in each document damaged by the virus, the number of bytes corresponding to each information type, and the influence coefficient of the information content per byte corresponding to each information type on the user,

[0022] The influence coefficient of each byte of information content corresponding to each information type on the user is obtained by querying the database, and the influence coefficient of each byte of information content corresponding to different information types on the user is different.

[0023] The number of bytes corresponding to the e1th information type in the eth document destroyed by each virus of the hth virus type within the second unit time before the current time is recorded as

[0024] The influence coefficient of the information content per byte in the e1th information type in the eth document destroyed by each virus of the hth virus type within the second unit time before the current time on the user

[0025] S1-3. Calculate the corresponding hazard coefficient of the hth virus type

[0026] he2 represents the number of information types in the e-th document destroyed by each virus of the h-th virus type within the second unit time before the current time;

[0027] The corresponding hazard coefficients of different types of viruses in the database are updated in real time. When the hazard coefficient of a virus type in the updated result is 0, the database will not be updated and the data before the update will be kept.

[0028] The state data of the user device being attacked by the virus in the first unit time is recorded as n1 , A2 n2 , A3 n3},

[0029] Among them, A1 represents the number of network viruses attacking the device, n1 represents the harm coefficient corresponding to each network virus,

[0030] A2 represents the number of file viruses that attack the device, and n2 represents the harm coefficient corresponding to each file virus.

[0031] A3 represents the number of boot viruses that attack the device, and n3 represents the harm coefficient corresponding to each boot virus.

[0032] The data acquisition module of the present invention does not include viruses that actually exist in the user device but cannot be killed in the acquired data, so that when the device information risk value is subsequently acquired, the impact value of the virus invading the device on the device document, that is, the device information risk value, can be accurately determined; the type of virus is acquired to classify the virus according to the attack characteristics of the virus, and its purpose is to take into account that the documents attacked by viruses with different attack characteristics are different, and the impact on the user is different, thereby providing a data basis for the subsequent acquisition of the device information risk value; in the process of acquiring the corresponding harm coefficients of different types of viruses in the database, the four aspects of the speed of the virus type destroying the document in the device, the type of information contained in each document destroyed by the virus, the number of bytes corresponding to each information type, and the impact coefficient of each byte of the information content corresponding to each information type on the user are comprehensively considered, and then the overall impact of the information content destroyed by the virus in the second unit time on the user is obtained, and the overall impact corresponding to different types of viruses is digitized, so as to facilitate the quantitative evaluation of the harm of the virus to the user, that is, to obtain the corresponding harm coefficients of different types of viruses, and to concretize and digitize the impact of different types of viruses on the device, so as to facilitate the accurate acquisition of the value corresponding to the device information risk value, thereby providing a basis for the subsequent process of The data provided by the system is used to evaluate the security of the device. The historical data is continuously updated with the change of time. In the process of obtaining the hazard coefficients corresponding to different virus types, the number of documents destroyed in the second unit time before the current time, the type of information contained in each document, and the number of bytes corresponding to each type of information are also different. Therefore, the hazard coefficients corresponding to the virus types also need to be continuously updated. At the same time, the continuous updating of the hazard coefficients is more in line with the assessment of the risk value of the device information. The impact of viruses on devices is not static. With the upgrade of the hardware and software of the device, the blocking effect of viruses will continue to increase. Therefore, the historical data within the second unit time before the current time is continuously obtained to obtain the hazard coefficients of the corresponding virus types. The results are relatively accurate. Since the referenced historical data is short from the current time, the hazard coefficients of the virus types corresponding to the historical data are of reference value to the current time. Therefore, the hazard coefficients of the virus types in the database are continuously updated to ensure the accuracy of the hazard coefficients. When the hazard coefficients corresponding to the virus types in the updated results are 0, the database will not be updated, and the data before the update will still be kept. This is to take into account that in the subsequent process of obtaining the risk value W of the device information, due to When the hazard coefficient of the virus type in the updated data is 0, it may cause The denominator of is equal to 0, which makes A meaningless situation occurs, which further makes the obtained W meaningless.

[0033] Furthermore, the manual operation state acquisition module acquires all operation records of the user on the device within the first unit time, each operation record including an operation type and a time point corresponding to the corresponding operation,

[0034] The operation types include web page operation in the browser, USB interface connection operation and desktop local operation.

[0035] Web page operations in the browser refer to the operation behavior of accessing different web pages through the browser.

[0036] USB interface connection operation refers to the operation of connecting external devices through the USB interface.

[0037] Desktop local operations refer to operations performed on local files on the device without using an external network.

[0038] The manual operation status acquisition module of the present invention obtains all operation records of the user on the device in order to obtain the tampering data of the document in the device caused by the user's manual operation, thereby providing a data basis for accurately obtaining the content deviation rate in the subsequent device identification information self-check module.

[0039] Furthermore, the device information self-check module will retrieve the device information backup before the first unit time based on the current time in the cloud storage during the process of self-checking the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time.

[0040] The content of the device information backup includes executable file data in the device's network, file data in the device, boot sector data and system boot sector data of the hard disk;

[0041] The device information self-checking module compares the executable files in the device network at the current time, the files in the device, the boot sector and the system boot sector of the hard disk with the device information backup before the first unit time based on the current time retrieved from the cloud storage, and obtains the deviation rate of the executable file content in the device network, the deviation rate of the file content in the device, and the deviation rate of the corresponding content of the boot sector and the system boot sector of the hard disk in the two compared parties, respectively.

[0042] The self-test result obtained by the device information self-test module is recorded as (c1, c2, c3).

[0043] Where c1 represents the deviation rate of the executable file content in the device network,

[0044] c2 represents the deviation rate of the file content in the device,

[0045] c3 represents the content deviation rate between the boot sector and the system boot sector of the hard disk;

[0046] The method for obtaining the deviation rate of each part of the content in the comparison of the two parties includes the following steps:

[0047] S1.1. Obtain the number of identical bytes in each corresponding document data in each part of the content of the two parties to be compared, in order from the front to the back.

[0048] In the document data corresponding to the i1th part of the i-th part of the comparison, the number of identical bytes is recorded as

[0049] S1.2. In the device information backup before the first unit time based on the current time retrieved from the cloud storage, the total number of bytes in the document data corresponding to the i1th item in the i-th part of the content is recorded as

[0050] S1.3. Obtain all operation records of the user on the device within the first unit time, and record the number of bytes changed in the document data corresponding to the i1th item in the i-th part as Said Indicates the number of bytes that are different from the previous bytes in the document data corresponding to the i1th part of the i-th content, in order from the front to the back;

[0051] S1.4, obtain the deviation rate Pi of the i-th part of the content of the two comparison parties,

[0052] Said Here, i2 represents the number of document data in the i-th part of the content of the two sides being compared.

[0053] The device information self-checking module of the present invention obtains the device information backup in order to compare it with the document content in the device at the current time, and then judge the change of the document content in the first unit time, and obtain the deviation rate of the executable file content in the device network, the deviation rate of the file content in the device, and the deviation rate of the corresponding content of the boot sector and the system boot sector of the hard disk; in the process of obtaining the deviation rate of each part of the content in the comparison, This is because it takes into account that tampering with the document content during human operation will also cause the document content to change, and then through right The sum of the two corresponds to the ratio of the theoretically normal number of bytes to the total number of bytes in the document in the presence of virus interference; It represents the ratio of the number of bytes tampered by the virus in the i1th corresponding document data in the i-th part of the content to the total number of bytes in the document after being affected by the virus, and then obtains the deviation rate of the document caused by the virus in the i1th corresponding document data in the i-th part of the content; calculate It is to calculate the sum of the corresponding deviation rates of all documents in the i-th part of the content of the two compared parties.

[0054] Furthermore, the device risk feature extraction module includes a virus feature extraction module and a risk feature acquisition module.

[0055] The virus feature extraction module obtains the script files currently running on the device, identifies the function of each script file one by one, determines the viruses in the script files running on the device according to the functions of the identified running script files, and extracts the virus features corresponding to the identified viruses;

[0056] The risk feature acquisition module obtains the virus features extracted by the virus feature extraction module, scans the document content in the device, identifies the documents with virus features in the device, and obtains the corresponding number of viruses. At the same time, according to the function of the script file corresponding to the virus, the type of virus is obtained, and then the risk feature results caused by the virus to the device are obtained.

[0057] Furthermore, the method for extracting the identified virus features by the virus feature extraction module includes the following steps:

[0058] S2.1, obtaining the functions of each running script file identified;

[0059] S2.2, determining whether the script file maliciously tampers with the document content, wherein malicious tampering refers to tampering with the document content into randomly generated garbled characters, and determining the script file that maliciously tampers with the document content as a virus;

[0060] S2.3, obtain the virus features corresponding to each virus, wherein the virus features include the code keywords corresponding to the corresponding virus, the virus type and the hazard coefficient corresponding to the corresponding virus type,

[0061] The code keywords are obtained by extracting keywords.

[0062] The virus type is determined by the part of the document to which the virus has tampered.

[0063] If the part of the document tampered by the corresponding virus belongs to an executable file in the device network, the type of the corresponding virus is a network virus.

[0064] If the part of the document tampered by the corresponding virus is a file in the device, the type of the corresponding virus is a file virus.

[0065] If the part of the document tampered by the corresponding virus belongs to the startup sector in the device and the system boot sector of the hard disk, the type of the corresponding virus is a boot virus.

[0066] Furthermore, the method for the risk feature acquisition module to obtain the risk feature result caused by the virus to the device includes the following steps:

[0067] S3.1. Obtain virus features extracted by a virus feature extraction module;

[0068] S3.2. According to the virus type in the virus signature corresponding to each virus, compare the document content corresponding to the virus type in the device with the code keywords in the virus signature to obtain a document containing the corresponding code keywords;

[0069] S3.3. Obtain the number of occurrences of the corresponding code keyword of the virus in the document containing the corresponding code keyword to obtain the number of the virus;

[0070] S3.4. Obtain the hazard coefficient corresponding to the virus type in the virus characteristics;

[0071] S3.5. Obtain the risk characteristic result caused by the virus to the device, and record the risk characteristic result caused by the mth running virus to the device as Fm.

[0072] Fm=Rm*n4 m , where Rm represents the number of the mth running virus in the device, n4 m Indicates the hazard coefficient corresponding to the virus type to which the mth running virus belongs;

[0073] S3.6. Obtain the risk characteristic result F caused by the virus to the device. F is equal to the sum of the risk characteristic results caused by all viruses running in the device to the device.

[0074] Said Here, m2 is equal to the total number of all viruses running in the device.

[0075] In the process of obtaining the risk characteristic result caused by the virus to the device by the risk characteristic acquisition module of the present invention, it is assumed that only one virus will be run after the virus invades, and other viruses with the same virus will be copied into the document and hidden. However, the hidden virus has the same effect as the corresponding running virus and the same harm to the device. When calculating the risk characteristic result Fm caused by the mth running virus to the device, let Fm = Rm*n4 m To obtain the risk characteristic result F caused by the virus to the device, it is necessary to consider the impact of all viruses running in the device and the potential viruses in the device on the device, and then first obtain the risk characteristic result caused by each running virus to the device, and then sum the obtained results.

[0076] Furthermore, the method for the device information security analysis module to obtain the device information risk value includes the following steps:

[0077] S4.1. Obtain the collection results of the data collection module, the corresponding self-check results in the device information self-check module, and the risk feature results caused by the virus to the device in the device risk feature extraction module;

[0078] S4.2. Normalize the results obtained in S4.1 to obtain the equipment information risk value W.

[0079] Said in,

[0080] Rgi represents the number of the gi-th running virus in the ith virus type that appears in the device.

[0081] Vi represents the number of viruses of the i-th virus type running in the device,

[0082] ni represents the hazard coefficient corresponding to the i-th virus type,

[0083] and and

[0084] The first virus type indicates a network virus.

[0085] The first virus type indicates a file virus.

[0086] The first virus type represents a boot-type virus.

[0087] In the process of obtaining the device information risk value by the device information security analysis module of the present invention, the calculation The purpose is to calculate the sum of the risk characteristics of each running virus in the i-th virus type to the device when i is different values; The purpose is to obtain the ratio of the sum of the risk characteristics of the i-th virus type that successfully invades the device to the sum of the risk characteristics of all the viruses that attack the device (those blocked by the device and those not blocked by the device). The purpose is to obtain the device information risk value caused by each running virus in the i-th virus type to the device; calculate The purpose is to obtain the device information risk value caused by each running virus among all virus types to the device.

[0088] Furthermore, after obtaining the device information risk value W, the device information security analysis module compares W with the database to obtain a security rating of the device.

[0089] A big data detection method based on information security, the method comprising the following steps:

[0090] S1. Acquire, through a data collection module, status data of a user device being attacked by a virus within a first unit of time;

[0091] S2. Acquire all operation records of the user on the device within a first unit of time through a manual operation status acquisition module;

[0092] S3, self-checking the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time through the device information self-checking module to obtain the corresponding self-checking results;

[0093] S4. Searching for script files currently running on the device through the device risk feature extraction module, identifying existing viruses, extracting features of the existing viruses, and obtaining risk feature results caused by the corresponding viruses to the device;

[0094] S5. Obtain the collection results of the data collection module, the corresponding self-check results in the equipment information self-check module, and the risk feature results caused by the virus to the equipment in the equipment risk feature extraction module through the equipment information security analysis module, and normalize the obtained results to obtain the equipment information risk value, and rate the equipment security according to the obtained equipment information risk value.

[0095] Compared with the prior art, the beneficial effect achieved by the present invention is that the present invention not only realizes the monitoring of viruses attacking devices and the impact on documents in the device, but also comprehensively considers various factors and evaluates the security of the device. This method can accurately judge the security status of the device by combining the attacking virus situation and the impact on the documents in the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0096] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0097] Figure 1 It is a structural schematic diagram of a big data detection system based on information security of the present invention;

[0098] Figure 2 It is a flow chart of a method for extracting and identifying virus features by a virus feature extraction module in a big data detection system based on information security of the present invention;

[0099] Figure 3 It is a flow chart of a method for a risk feature acquisition module in a big data detection system based on information security of the present invention to obtain risk feature results caused by a virus to a device;

[0100] Figure 4 It is a flow chart of the big data detection method based on information security of the present invention. DETAILED DESCRIPTION

[0101] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0102] See also Figure 1-Figure 4 The present invention provides a technical solution: a big data detection system based on information security, including: a data acquisition module, a manual operation status acquisition module, an equipment information self-checking module, an equipment risk feature extraction module and an equipment information security analysis module,

[0103] The data collection module is used to obtain status data of the user device being attacked by a virus within a first unit time;

[0104] The manual operation status acquisition module acquires all operation records of the user on the device within a first unit time;

[0105] The device information self-check module performs self-check on the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time to obtain the corresponding self-check result;

[0106] The device risk feature extraction module searches for script files currently running on the device, identifies existing viruses, extracts features of the existing viruses, and obtains risk feature results caused by the corresponding viruses to the device;

[0107] The device information security analysis module obtains the collection results of the data collection module, the corresponding self-check results in the device information self-check module, and the risk feature results caused by the virus to the device in the device risk feature extraction module, and normalizes the obtained results to obtain the device information risk value, and rates the device security according to the obtained device information risk value.

[0108] The present invention realizes the monitoring of viruses that attack devices and their impact on documents in the device through the collaborative cooperation of various modules, and then comprehensively considers various factors to evaluate the security of the device. This method can accurately judge the security status of the device by combining the attacking virus situation and the impact on the documents in the device.

[0109] The data collection module obtains the status data of the user device being attacked by a virus within the first unit time. The data obtained by the data collection module refers to the situation where the user device detects that it is attacked by a virus but successfully defends against it. Viruses that actually exist in the user device but cannot be killed are not included in the obtained data.

[0110] The status data of the user device being attacked by viruses in the first unit time includes the type of virus that attacks the device each time and the corresponding harm coefficient.

[0111] The types of viruses that attack devices include network viruses, file viruses and boot viruses.

[0112] Different types of viruses will damage different areas of a device and have different corresponding risk factors.

[0113] Network viruses damage executable files in the device network, file viruses damage files in the device, and boot viruses damage the boot sector of the device and the system boot sector of the hard disk.

[0114] The corresponding harm coefficients of different types of viruses are obtained through database matching.

[0115] The method for obtaining the corresponding harm coefficients of different types of viruses in the database includes the following steps:

[0116] S1-1, obtaining the speed at which various types of viruses that successfully invade a device damage the documents in the device in historical data, and recording the number of documents damaged by each virus of the hth virus type in the second unit time before the current time as vph;

[0117] S1-2, obtaining the information type contained in each document damaged by the virus, the number of bytes corresponding to each information type, and the influence coefficient of the information content per byte corresponding to each information type on the user,

[0118] The influence coefficient of each byte of information content corresponding to each information type on the user is obtained by querying the database, and the influence coefficient of each byte of information content corresponding to different information types on the user is different.

[0119] The number of bytes corresponding to the e1th information type in the eth document destroyed by each virus of the hth virus type within the second unit time before the current time is recorded as

[0120] The influence coefficient of the information content per byte in the e1th information type in the eth document destroyed by each virus of the hth virus type within the second unit time before the current time on the user

[0121] S1-3. Calculate the corresponding hazard coefficient of the hth virus type

[0122] he2 represents the number of information types in the e-th document destroyed by each virus of the h-th virus type within the second unit time before the current time;

[0123] The corresponding hazard coefficients of different types of viruses in the database are updated in real time. When the hazard coefficient of a virus type in the updated result is 0, the database will not be updated and the data before the update will be kept.

[0124] In this embodiment, the number of documents destroyed by each virus of the file virus type in the second unit time before the current time is 2 documents, namely, the first document and the second document.

[0125] If the information types contained in the first document and the number of bytes corresponding to each information type are: the first information type and the corresponding number of bytes are 300, the second information type and the corresponding number of bytes are 100, and the third information type and the corresponding number of bytes are 200;

[0126] If the information types contained in the second document and the number of bytes corresponding to each information type are: the first information type and the corresponding number of bytes are 100, the third information type and the corresponding number of bytes are 100, and the fourth information type and the corresponding number of bytes are 500;

[0127] If the influence coefficient of each byte of information content corresponding to the first information type in the database on the user is 0.001,

[0128] The influence coefficient of each byte of information content corresponding to the second information type in the database on the user is 0.003.

[0129] The influence coefficient of each byte of information content corresponding to the third information type in the database on the user is 0.005.

[0130] The influence coefficient of each byte of information content corresponding to the fourth information type in the database on the user is 0.002.

[0131] Then the relative harm coefficient of the file virus is equal to

[0132] (300*0.001+100*0.003+200*0.005)+(100*0.001+100*0.005+500*0.002)=1.9+1.6=3.5.

[0133] The state data of the user device being attacked by the virus in the first unit time is recorded as n1 , A2 n2 , A3 n3},

[0134] Among them, A1 represents the number of network viruses attacking the device, n1 represents the harm coefficient corresponding to each network virus,

[0135] A2 represents the number of file viruses that attack the device, and n2 represents the harm coefficient corresponding to each file virus.

[0136] A3 represents the number of boot viruses that attack the device, and n3 represents the harm coefficient corresponding to each boot virus.

[0137] The data acquisition module of the present invention does not include viruses that actually exist in the user device but cannot be killed in the acquired data, so that when the device information risk value is subsequently acquired, the impact value of the virus invading the device on the device document, that is, the device information risk value, can be accurately determined; the type of virus is acquired to classify the virus according to the attack characteristics of the virus, and its purpose is to take into account that the documents attacked by viruses with different attack characteristics are different, and the impact on the user is different, thereby providing a data basis for the subsequent acquisition of the device information risk value; in the process of acquiring the corresponding harm coefficients of different types of viruses in the database, the four aspects of the speed of the virus type destroying the document in the device, the type of information contained in each document destroyed by the virus, the number of bytes corresponding to each information type, and the impact coefficient of each byte of the information content corresponding to each information type on the user are comprehensively considered, and then the overall impact of the information content destroyed by the virus in the second unit time on the user is obtained, and the overall impact corresponding to different types of viruses is digitized, so as to facilitate the quantitative evaluation of the harm of the virus to the user, that is, to obtain the corresponding harm coefficients of different types of viruses, and to concretize and digitize the impact of different types of viruses on the device, so as to facilitate the accurate acquisition of the value corresponding to the device information risk value, thereby providing a basis for the subsequent process of The data provided by the system is used to evaluate the security of the device. The historical data is continuously updated with the change of time. In the process of obtaining the hazard coefficients corresponding to different virus types, the number of documents destroyed in the second unit time before the current time, the type of information contained in each document, and the number of bytes corresponding to each type of information are also different. Therefore, the hazard coefficients corresponding to the virus types also need to be continuously updated. At the same time, the continuous updating of the hazard coefficients is more in line with the assessment of the risk value of the device information. The impact of viruses on devices is not static. With the upgrade of the hardware and software of the device, the blocking effect of viruses will continue to increase. Therefore, the historical data within the second unit time before the current time is continuously obtained to obtain the hazard coefficients of the corresponding virus types. The results are relatively accurate. Since the referenced historical data is short from the current time, the hazard coefficients of the virus types corresponding to the historical data are of reference value to the current time. Therefore, the hazard coefficients of the virus types in the database are continuously updated to ensure the accuracy of the hazard coefficients. When the hazard coefficients corresponding to the virus types in the updated results are 0, the database will not be updated, and the data before the update will still be kept. This is to take into account that in the subsequent process of obtaining the risk value W of the device information, due to When the hazard coefficient of the virus type in the updated data is 0, it may cause The denominator of is equal to 0, which makes A meaningless situation occurs, which further makes the obtained W meaningless.

[0138] The manual operation status acquisition module acquires all operation records of the user on the device within a first unit time, each operation record including an operation type and a time point corresponding to the corresponding operation,

[0139] The operation types include web page operation in the browser, USB interface connection operation and desktop local operation.

[0140] Web page operations in the browser refer to the operation behavior of accessing different web pages through the browser.

[0141] USB interface connection operation refers to the operation of connecting external devices through the USB interface.

[0142] Desktop local operations refer to operations performed on local files on the device without using an external network.

[0143] The manual operation status acquisition module of the present invention obtains all operation records of the user on the device in order to obtain the tampering data of the document in the device caused by the user's manual operation, thereby providing a data basis for accurately obtaining the content deviation rate in the subsequent device identification information self-check module.

[0144] The device information self-check module performs self-check on the executable files in the device network at the current time, the files in the device, the boot sector and the system boot sector of the hard disk, and retrieves the device information backup before the first unit time based on the current time in the cloud storage.

[0145] The content of the device information backup includes executable file data in the device's network, file data in the device, boot sector data and system boot sector data of the hard disk;

[0146] The device information self-checking module compares the executable files in the device network at the current time, the files in the device, the boot sector and the system boot sector of the hard disk with the device information backup before the first unit time based on the current time retrieved from the cloud storage, and obtains the deviation rate of the executable file content in the device network, the deviation rate of the file content in the device, and the deviation rate of the corresponding content of the boot sector and the system boot sector of the hard disk in the two compared parties, respectively.

[0147] The self-test result obtained by the device information self-test module is recorded as (c1, c2, c3).

[0148] Where c1 represents the deviation rate of the executable file content in the device network,

[0149] c2 represents the deviation rate of the file content in the device,

[0150] c3 represents the content deviation rate between the boot sector and the system boot sector of the hard disk;

[0151] The method for obtaining the deviation rate of each part of the content in the comparison of the two parties includes the following steps:

[0152] S1.1. Obtain the number of identical bytes in each corresponding document data in each part of the content of the two parties to be compared, in order from the front to the back.

[0153] In the document data corresponding to the i1th part of the i-th part of the comparison, the number of identical bytes is recorded as

[0154] S1.2. In the device information backup before the first unit time based on the current time retrieved from the cloud storage, the total number of bytes in the document data corresponding to the i1th item in the i-th part of the content is recorded as

[0155] S1.3. Obtain all operation records of the user on the device within the first unit time, and record the number of bytes changed in the document data corresponding to the i1th item in the i-th part as Said Indicates the number of bytes that are different from the previous bytes in the document data corresponding to the i1th part of the i-th content, in order from the front to the back;

[0156] S1.4, obtain the deviation rate Pi of the i-th part of the content of the two comparison parties,

[0157] Said Here, i2 represents the number of document data in the i-th part of the content of the two sides being compared.

[0158] The device information self-checking module of the present invention obtains the device information backup in order to compare it with the document content in the device at the current time, and then judge the change of the document content in the first unit time, and obtain the deviation rate of the executable file content in the device network, the deviation rate of the file content in the device, and the deviation rate of the corresponding content of the boot sector and the system boot sector of the hard disk; in the process of obtaining the deviation rate of each part of the content in the comparison, This is because it takes into account that tampering with the document content during human operation will also cause the document content to change, and then through right The sum of the two corresponds to the ratio of the theoretically normal number of bytes to the total number of bytes in the document in the presence of virus interference; It represents the ratio of the number of bytes tampered by the virus in the i1th corresponding document data in the i-th part of the content to the total number of bytes in the document after being affected by the virus, and then obtains the deviation rate of the document caused by the virus in the i1th corresponding document data in the i-th part of the content; calculate It is to calculate the sum of the corresponding deviation rates of all documents in the i-th part of the content of the two compared parties.

[0159] The device risk feature extraction module includes a virus feature extraction module and a risk feature acquisition module.

[0160] The virus feature extraction module obtains the script files currently running on the device, identifies the function of each script file one by one, determines the viruses in the script files running on the device according to the functions of the identified running script files, and extracts the virus features corresponding to the identified viruses;

[0161] The risk feature acquisition module obtains the virus features extracted by the virus feature extraction module, scans the document content in the device, identifies the documents with virus features in the device, and obtains the corresponding number of viruses. At the same time, according to the function of the script file corresponding to the virus, the type of virus is obtained, and then the risk feature results caused by the virus to the device are obtained.

[0162] The method for extracting the identified virus features by the virus feature extraction module comprises the following steps:

[0163] S2.1, obtaining the functions of each running script file identified;

[0164] S2.2, determining whether the script file maliciously tampers with the document content, wherein malicious tampering refers to tampering with the document content into randomly generated garbled characters, and determining the script file that maliciously tampers with the document content as a virus;

[0165] S2.3, obtain the virus features corresponding to each virus, wherein the virus features include the code keywords corresponding to the corresponding virus, the virus type and the hazard coefficient corresponding to the corresponding virus type,

[0166] The code keywords are obtained by extracting keywords.

[0167] The virus type is determined by the part of the document to which the virus has tampered.

[0168] If the part of the document tampered by the corresponding virus belongs to an executable file in the device network, the type of the corresponding virus is a network virus.

[0169] If the part of the document tampered by the corresponding virus is a file in the device, the type of the corresponding virus is a file virus.

[0170] If the part of the document tampered by the corresponding virus belongs to the startup sector in the device and the system boot sector of the hard disk, the type of the corresponding virus is a boot virus.

[0171] The method for the risk feature acquisition module to obtain the risk feature result caused by the virus to the device includes the following steps:

[0172] S3.1. Obtain virus features extracted by a virus feature extraction module;

[0173] S3.2. According to the virus type in the virus signature corresponding to each virus, compare the document content corresponding to the virus type in the device with the code keywords in the virus signature to obtain a document containing the corresponding code keywords;

[0174] S3.3. Obtain the number of occurrences of the corresponding code keyword of the virus in the document containing the corresponding code keyword to obtain the number of the virus;

[0175] S3.4. Obtain the hazard coefficient corresponding to the virus type in the virus characteristics;

[0176] S3.5. Obtain the risk characteristic result caused by the virus to the device, and record the risk characteristic result caused by the mth running virus to the device as Fm.

[0177] Fm=Rm*n4 m , where Rm represents the number of the mth running virus in the device, n4 m Indicates the hazard coefficient corresponding to the virus type to which the mth running virus belongs;

[0178] S3.6. Obtain the risk characteristic result F caused by the virus to the device. F is equal to the sum of the risk characteristic results caused by all viruses running in the device to the device.

[0179] Said Here, m2 is equal to the total number of all viruses running in the device.

[0180] In the process of obtaining the risk characteristic result caused by the virus to the device by the risk characteristic acquisition module of the present invention, it is assumed that only one virus will be run after the virus invades, and other viruses with the same virus will be copied into the document and hidden. However, the hidden virus has the same effect as the corresponding running virus and the same harm to the device. When calculating the risk characteristic result Fm caused by the mth running virus to the device, let Fm = Rm*n4 m To obtain the risk characteristic result F caused by the virus to the device, it is necessary to consider the impact of all viruses running in the device and the potential viruses in the device on the device, and then first obtain the risk characteristic result caused by each running virus to the device, and then sum the obtained results.

[0181] The method for obtaining the device information risk value by the device information security analysis module comprises the following steps:

[0182] S4.1. Obtain the collection results of the data collection module, the corresponding self-check results in the device information self-check module, and the risk feature results caused by the virus to the device in the device risk feature extraction module;

[0183] S4.2. Normalize the results obtained in S4.1 to obtain the equipment information risk value W.

[0184] Said in,

[0185] Rgi represents the number of the gi-th running virus in the ith virus type that appears in the device.

[0186] Vi represents the number of viruses of the i-th virus type running in the device,

[0187] ni represents the hazard coefficient corresponding to the i-th virus type,

[0188] and and

[0189] The first virus type indicates a network virus.

[0190] The first virus type indicates a file virus.

[0191] The first virus type represents a boot-type virus.

[0192] In the process of obtaining the device information risk value by the device information security analysis module of the present invention, the calculation The purpose is to calculate the sum of the risk characteristics of each running virus in the i-th virus type to the device when i is different values; The purpose is to obtain the ratio of the sum of the risk characteristics of the i-th virus type that successfully invades the device to the sum of the risk characteristics of all the viruses that attack the device (those blocked by the device and those not blocked by the device). The purpose is to obtain the device information risk value caused by each running virus in the i-th virus type to the device; calculate The purpose is to obtain the device information risk value caused by each running virus among all virus types to the device.

[0193] After obtaining the device information risk value W, the device information security analysis module compares W with the database to obtain the device security rating.

[0194] A big data detection method based on information security, the method comprising the following steps:

[0195] S1. Acquire, through a data collection module, status data of a user device being attacked by a virus within a first unit of time;

[0196] S2. Acquire all operation records of the user on the device within a first unit of time through a manual operation status acquisition module;

[0197] S3, self-checking the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time through the device information self-checking module to obtain the corresponding self-checking results;

[0198] S4. Searching for script files currently running on the device through the device risk feature extraction module, identifying existing viruses, extracting features of the existing viruses, and obtaining risk feature results caused by the corresponding viruses to the device;

[0199] S5. Obtain the collection results of the data collection module, the corresponding self-check results in the equipment information self-check module, and the risk feature results caused by the virus to the equipment in the equipment risk feature extraction module through the equipment information security analysis module, and normalize the obtained results to obtain the equipment information risk value, and rate the equipment security according to the obtained equipment information risk value.

[0200] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0201] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A big data detection system based on information security, characterized in that: include: Data collection module, manual operation status acquisition module, equipment information self-check module, equipment risk feature extraction module and equipment information security analysis module, The data collection module is used to obtain status data of the user device being attacked by a virus within a first unit time; The data collected by the data collection module refers to the situation where the user device detects that it has been attacked by a virus but has successfully defended itself. Viruses that actually exist in the user device but cannot be killed are not included in the collected data. The status data of the user device being attacked by viruses in the first unit time includes the type of virus that attacks the device each time and the corresponding harm coefficient. The types of viruses that attack devices include network viruses, file viruses and boot viruses. Different types of viruses will damage different areas of a device and have different corresponding risk factors. Network viruses damage executable files in the device network, file viruses damage files in the device, and boot viruses damage the boot sector of the device and the system boot sector of the hard disk. The corresponding harm coefficients of different types of viruses are obtained through database matching. The method for obtaining the corresponding harm coefficients of different types of viruses in the database includes the following steps: S1-1, obtaining the speed at which various types of viruses that successfully invade a device damage the documents in the device in historical data, and recording the number of documents damaged by each virus of the hth virus type in the second unit time before the current time as vph; S1-2, obtaining the information type contained in each document damaged by the virus, the number of bytes corresponding to each information type, and the influence coefficient of the information content per byte corresponding to each information type on the user, The influence coefficient of each byte of information content corresponding to each information type on the user is obtained by querying the database, and the influence coefficient of each byte of information content corresponding to different information types on the user is different. The number of bytes corresponding to the e1th information type in the eth document destroyed by each virus of the hth virus type within the second unit time before the current time is recorded as The influence coefficient of the information content per byte in the e1th information type in the eth document destroyed by each virus of the hth virus type within the second unit time before the current time on the user S1-3. Calculate the corresponding hazard coefficient of the hth virus type he2 represents the number of information types in the e-th document destroyed by each virus of the h-th virus type within the second unit time before the current time; The corresponding hazard coefficients of different types of viruses in the database are updated in real time. When the hazard coefficient of a virus type in the updated result is 0, the database will not be updated and the data before the update will be kept. The state data of the user device being attacked by the virus in the first unit time is recorded as n1 , A2 n2 , A3 n3}， Among them, A1 represents the number of network viruses attacking the device, n1 represents the harm coefficient corresponding to each network virus, A2 represents the number of file viruses that attack the device, and n2 represents the harm coefficient corresponding to each file virus. A3 represents the number of boot viruses that attack the device, and n3 represents the harm coefficient corresponding to each boot virus; The manual operation status acquisition module acquires all operation records of the user on the device within a first unit time; Each operation record includes the type of operation and the time point corresponding to the corresponding operation. The operation types include web page operation in the browser, USB interface connection operation and desktop local operation. Web page operations in the browser refer to the operation behavior of accessing different web pages through the browser. USB interface connection operation refers to the operation of connecting external devices through the USB interface. Desktop local operations refer to operations on local files on the device without using external networks; The device information self-check module performs self-check on the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time to obtain the corresponding self-check result; The device information self-check module performs self-check on the executable files in the device network at the current time, the files in the device, the boot sector and the system boot sector of the hard disk, and retrieves the device information backup before the first unit time based on the current time in the cloud storage. The content of the device information backup includes executable file data in the device's network, file data in the device, boot sector data and system boot sector data of the hard disk; The device information self-checking module compares the executable files in the device network at the current time, the files in the device, the boot sector and the system boot sector of the hard disk with the device information backup before the first unit time based on the current time retrieved from the cloud storage, and obtains the deviation rate of the executable file content in the device network, the deviation rate of the file content in the device, and the deviation rate of the corresponding content of the boot sector and the system boot sector of the hard disk in the two compared parties, respectively. The self-test result obtained by the device information self-test module is recorded as (c1, c2, c3). Where c1 represents the deviation rate of the executable file content in the device network, c2 represents the deviation rate of the file content in the device, c3 represents the content deviation rate between the boot sector and the system boot sector of the hard disk; The method for obtaining the deviation rate of each part of the content in the comparison of the two parties includes the following steps: S1.

1. Obtain the number of identical bytes in each corresponding document data in each part of the content of the two parties to be compared, in order from the front to the back. In the document data corresponding to the i1th part of the i-th part of the comparison, the number of identical bytes is recorded as S1.

2. In the device information backup before the first unit time based on the current time retrieved from the cloud storage, the total number of bytes in the document data corresponding to the i1th item in the i-th part of the content is recorded as S1.

3. Obtain all operation records of the user on the device in the first unit time, and record the number of bytes changed in the document data corresponding to the i1th item in the i-th part as Said Indicates the number of bytes that are different from the previous bytes after the change in the document data corresponding to the i1th part of the i-th content, in order from the front to the back; S1.4, obtain the deviation rate Pi of the i-th part of the content of the two comparison parties, Said Among them, i2 represents the number of document data in the i-th part of the content of the two parties to be compared; The device risk feature extraction module searches for script files currently running on the device, identifies existing viruses, extracts features of the existing viruses, and obtains risk feature results caused by the corresponding viruses to the device; The device risk feature extraction module includes a virus feature extraction module and a risk feature acquisition module. The virus feature extraction module obtains the script files currently running on the device, identifies the function of each script file one by one, determines the viruses in the script files running on the device according to the functions of the identified running script files, and extracts the virus features corresponding to the identified viruses; The method for extracting the identified virus features by the virus feature extraction module comprises the following steps: S2.1, obtaining the functions of each running script file identified; S2.2, determining whether the script file maliciously tampers with the document content, wherein malicious tampering refers to tampering with the document content into randomly generated garbled characters, and determining the script file that maliciously tampers with the document content as a virus; S2.3, obtain the virus features corresponding to each virus, wherein the virus features include the code keywords corresponding to the corresponding virus, the virus type and the hazard coefficient corresponding to the corresponding virus type, The code keywords are obtained by extracting keywords. The virus type is determined by the part of the document to which the virus has tampered. If the part of the document tampered by the corresponding virus belongs to an executable file in the device network, the type of the corresponding virus is a network virus. If the part of the document tampered by the corresponding virus is a file in the device, the type of the corresponding virus is a file virus. If the part of the document tampered by the corresponding virus belongs to the boot sector in the device and the system boot sector of the hard disk, the type of the corresponding virus is a boot virus; The risk feature acquisition module acquires the virus features extracted by the virus feature extraction module, scans the document content in the device, identifies the documents with virus features in the device, and acquires the corresponding number of viruses. At the same time, according to the role of the script file corresponding to the virus, the type of virus is acquired, and then the risk feature result caused by the virus to the device is obtained; The method for the risk feature acquisition module to obtain the risk feature result caused by the virus to the device includes the following steps: S3.

1. Obtain virus features extracted by a virus feature extraction module; S3.

2. According to the virus type in the virus signature corresponding to each virus, compare the document content corresponding to the virus type in the device with the code keywords in the virus signature to obtain a document containing the corresponding code keywords; S3.

3. Obtain the number of occurrences of the corresponding code keyword of the virus in the document containing the corresponding code keyword to obtain the number of the virus; S3.

4. Obtain the hazard coefficient corresponding to the virus type in the virus characteristics; S3.

5. Obtain the risk characteristic result caused by the virus to the device, and record the risk characteristic result caused by the mth running virus to the device as Fm. Fm=Rm*n4 m , where Rm represents the number of the mth running virus in the device, n4 m Indicates the hazard coefficient corresponding to the virus type to which the mth running virus belongs; S3.

6. Obtain the risk characteristic result F caused by the virus to the device. F is equal to the sum of the risk characteristic results caused by all viruses running in the device to the device. Said Where m2 is equal to the total number of all viruses running in the device; The device information security analysis module obtains the collection results of the data collection module, the corresponding self-check results in the device information self-check module, and the risk feature results caused by the virus to the device in the device risk feature extraction module, and normalizes the obtained results to obtain the device information risk value, and rates the device security according to the obtained device information risk value; The method for obtaining the device information risk value by the device information security analysis module comprises the following steps: S4.

1. Obtain the collection results of the data collection module, the corresponding self-check results in the device information self-check module, and the risk feature results caused by the virus to the device in the device risk feature extraction module; S4.

2. Normalize the results obtained in S4.1 to obtain the equipment information risk value W. Said in, Rgi represents the number of the gi-th running virus in the ith virus type that appears in the device. Vi represents the number of viruses of the i-th virus type running in the device, ni represents the hazard coefficient corresponding to the i-th virus type, and and The first virus type indicates a network virus. The first virus type indicates a file virus. The first virus type represents a boot-type virus.

2. The big data detection system based on information security according to claim 1 is characterized in that: After obtaining the device information risk value W, the device information security analysis module compares W with the database to obtain the device security rating.

3. The information security-based big data detection method using the information security-based big data detection system according to any one of claims 1 to 2 is characterized in that: The method comprises the following steps: S1. Acquire, through a data collection module, status data of a user device being attacked by a virus within a first unit time; S2. Acquire all operation records of the user on the device within a first unit of time through a manual operation status acquisition module; S3, self-checking the executable files in the device network, the files in the device, the boot sector and the system boot sector of the hard disk at the current time through the device information self-checking module to obtain the corresponding self-checking results; S4. Searching for script files currently running on the device through the device risk feature extraction module, identifying existing viruses, extracting features of the existing viruses, and obtaining risk feature results caused by the corresponding viruses to the device; S5. Obtain the collection results of the data collection module, the corresponding self-check results in the equipment information self-check module, and the risk feature results caused by the virus to the equipment in the equipment risk feature extraction module through the equipment information security analysis module, and normalize the obtained results to obtain the equipment information risk value, and rate the equipment security according to the obtained equipment information risk value.

Images