A network data security detection system and method based on zero trust

Abstract

The present invention belongs to the field of network security, and specifically relates to a network data security detection system and method based on zero trust. The system and method include: step S1: the network management device saves the pre-set network data security detection logic to the logic storage unit; step S2: the network management device includes an analysis management unit, and the analysis management unit establishes data distribution; step S3: the analysis management unit analyzes the subsequent first data packet in real time and determines the first distance between the first data packet and the center; step S4: the user end receives the call information, and the user of the user end determines whether to send user information to the network management device based on the call information. The beneficial effect of the present invention is that it can accurately determine the access rights of the user end, thereby ensuring the security of network data.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically to a zero-trust network data security detection system and method. Background Art

[0002] With the rapid development of information technology and its widespread penetration into all industries, cybersecurity no longer solely impacts cyberspace; it also significantly impacts businesses' production, operations, and technology in the physical world. While information technology can help businesses upgrade, transform, and rapidly grow, it also presents a new challenge: information security. For technology companies in particular, the leakage of core technology or code can be life-threatening.

[0003] Among the existing technologies, most use zero-trust-based authentication to verify user identities and determine user access rights, thereby preventing illegal users from accessing target addresses or data. Its disadvantage is that it does not fully utilize the zero-trust mechanism to detect and analyze network data and user-side related data. Therefore, many problems that threaten network security or performance are not detected in the existing zero-trust-based system. Moreover, the traditional zero-trust analysis method does not consider the relationship between the circular sliding window and data distribution and their judgment. When judging permissions, it does not combine user information for judgment. The judgment method is not accurate enough. In a complex data environment, even the zero-trust method cannot guarantee absolute security. Summary of the Invention

[0004] In order to better solve the above problems, the present invention provides a network data security detection method based on zero trust, comprising the following steps:

[0005] Step S1: The network management device saves the pre-set network data security detection logic to the logic storage unit;

[0006] Step S2: The network management device includes an analysis management unit, which establishes a data distribution, uses a fixed radius r as a sliding window to perform mean shift analysis and obtain the center of the spherical distribution;

[0007] Step S3: The analysis management unit analyzes the subsequent first data packet in real time and determines a first distance between the first data packet and the center; when the first distance is greater than a first threshold, the analysis management unit does not allow the user terminal corresponding to the first data packet to access the target data; when the first distance is less than the first threshold, the analysis management unit further determines whether the first distance is less than a second threshold; when the first distance is greater than the second threshold, the analysis management unit does not allow the user terminal to access the target data; when the first distance is less than the second threshold, the analysis management unit sends a call message to the user; the first threshold is more than twice the second threshold;

[0008] Step S4: the user terminal receives the call information, and the user of the user terminal determines whether to send user information to the analysis management unit based on the call information;

[0009] The ratio of the second threshold to the fixed radius is k, and the range of k is greater than one third and less than one half.

[0010] As a preferred technical solution of the present invention, step S2 includes:

[0011] Step S21: The analysis management unit detects data packets in the network in real time;

[0012] Step S22: the analysis management unit analyzes the data packet using a mean shift algorithm, wherein the mean shift algorithm performs shifting based on a circular sliding window;

[0013] Step S23: obtaining a spherical distribution of data through the analysis management unit, wherein the spherical distribution matches the circular sliding window;

[0014] Step S24: The analysis management unit obtains the center of the spherical distribution according to the spherical distribution, where the center is the center of the set with the highest data density of the spherical distribution.

[0015] As a preferred technical solution of the present invention, in step S2, the spherical distribution is obtained by the following formula:

[0016]

[0017] Where t is the center of the spherical distribution, t i is the quantized value of the i-th data packet after analysis by the analysis management unit, m is the number of data packets within the radius r, s is the negative derivative of the kernel function in the mean shift algorithm, y r (t) is the shifted mean of t, where k is one-half.

[0018] As a preferred technical solution of the present invention, step S4 further includes step S5:

[0019] The analysis management unit receives the user information, adds the user information to the first data packet to form a second data packet, and analyzes the second data packet to determine a second distance from the center again.

[0020] As a preferred technical solution of the present invention, step S5 further includes step S6:

[0021] When the second distance is greater than a third threshold, the analysis management unit does not allow the user terminal to access the target data; when the second distance is less than the third threshold, the analysis management unit allows the user terminal to access the target data, and the second threshold is more than twice the third threshold.

[0022] As a preferred technical solution of the present invention, the user information includes user-related information stored by the user terminal, the related information includes the user's historical data, the historical data includes a collection of data packets sent by the user terminal within a predetermined time, and the data packets include data packet length information, content information and access address information.

[0023] The present invention also provides a network data security detection system based on zero trust, the system comprising:

[0024] The logic storage unit is used to store the network data security detection logic of the network management equipment;

[0025] A network management device, comprising an analysis management unit, wherein the network management device is configured to: save the pre-set detection logic of the network data security to the logic storage unit;

[0026] The analysis management unit is configured to: establish a data distribution, use a fixed radius r as a sliding window to perform mean shift analysis and obtain the center of the spherical distribution; the analysis management unit analyzes a subsequent first data packet and determines a first distance from the center; when the first distance is greater than a first threshold, the analysis management unit does not allow the user terminal corresponding to the first data packet to access the target data; when the first distance is less than the first threshold, further determine whether the first distance is less than a second threshold; when the first distance is greater than the second threshold, the analysis management unit does not allow the user terminal to access the target data; when the first distance is less than the second threshold, the analysis management unit sends a call message to the user terminal; the first threshold is more than twice the second threshold;

[0027] The user terminal is configured to: receive the call information, and the user of the user terminal determines whether to send user information to the analysis management unit based on the call information;

[0028] The ratio of the second threshold to the fixed radius is k, and the range of k is greater than one third and less than one half.

[0029] As a preferred technical solution of the present invention, the analysis and management unit is further configured to: detect data packets in the network in real time, analyze the data packets using a mean shift algorithm, and obtain a spherical distribution of the data, wherein the mean shift algorithm is based on a circular sliding window for shifting, the spherical distribution matches the circular sliding window, and the center of the spherical distribution is obtained based on the spherical distribution, and the center is the center of the set with the highest data density.

[0030] As a preferred technical solution of the present invention, the spherical distribution is obtained by the following formula:

[0031]

[0032] Where t is the center of the spherical distribution, t i is the quantized value of the i-th data packet after analysis by the analysis management unit, m is the number of data packets within the radius r, s is the negative derivative of the kernel function in the mean shift algorithm, y r (t) is the shifted mean of t, where k is one-half.

[0033] As a preferred technical solution of the present invention, the analysis management unit is further configured to: receive the user information, add the user information to the first data packet to form a second data packet, the analysis management unit analyzes the second data packet, and again determines a second distance from the center; when the second distance is greater than a third threshold, the analysis management unit does not allow the user terminal to access the target data; when the second distance is less than the third threshold, the analysis management unit allows the user terminal to access the target data, and the second threshold is more than twice the third threshold;

[0034] The user information includes user-related information stored by the user terminal, the related information includes the user's historical data, the historical data includes a collection of data packets sent by the user terminal within a predetermined time, and the data packets include data packet length information, content information and access address information.

[0035] Compared with the prior art, the beneficial effects of the present invention are at least as follows:

[0036] The technical solution of the present invention integrates the analysis management unit into the network management device in a zero-trust network, thereby not only being able to directly detect the access rights of the user terminal corresponding to the data packet according to the detection logic in the network management device, but also being able to further confirm the access rights of the user terminal by analyzing the data packet. Through the mutual cooperation between the network management device and the analysis unit, the access rights of the user terminal can be confirmed more accurately. A circular sliding window with a fixed radius r set in the mean shift algorithm is also used to better match the spherical distribution, making the obtained spherical distribution data more accurate, improving the accuracy of zero-trust data, and avoiding the reduction in data accuracy at the edge of the spherical distribution due to other methods not matching the spherical distribution, or even reducing the accuracy of data near the center. At the same time, when the first distance between the first data packet and the center is less than a second threshold, user information is added to the first data packet to obtain a second data packet. The length information, access address and content information of the data packet are analyzed through the communication protocol to determine the integrity of the data packet and obtain a record of its access to the target data. Through the mutual cooperation of the above technical solutions, the user terminal's permissions can be accurately determined, thereby ensuring the security of network data. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart of a network data security detection method based on zero trust in the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0039] The present invention provides a network data security detection method based on zero trust, such as Figure 1 As shown, the following steps are included:

[0040] Step S1: The network management device saves the pre-set network data security detection logic to the logic storage unit; in this step, the logic storage unit is used to store the network data security detection logic predetermined by the network management device, and when the detection logic is adjusted, it needs to be saved again; wherein, the network management device is used to detect the access rights of the user terminal to the target data, file or system in the zero-trust network, and the detection logic is the access rule for normal access to the target data, file or system;

[0041] Step S2: The network management device integrates an analysis management unit, which establishes a data distribution, uses a fixed radius r as a sliding window to perform mean shift analysis, and obtains the center of the spherical distribution. In this step, the analysis management unit establishes the distribution of data packets in the network, analyzes the data packets, and based on the quantization results, uses a fixed radius r as a sliding window to perform mean shift analysis to obtain a spherical distribution and the center of the spherical distribution, and uses the center as a reference point for access rights judgment. By integrating the analysis unit into the network management device, not only can the access rights of the user terminal corresponding to the data packet be directly detected according to the detection logic in the network management device, but the user terminal's rights can also be further confirmed by analyzing the data packet. Through the mutual cooperation between the network management device and the analysis unit, the user terminal's rights can be confirmed more accurately. At the same time, the use of a circular sliding window with a fixed radius r set in the mean shift algorithm can better match the spherical distribution, making the obtained spherical distribution data more accurate, improving the accuracy of zero-trust data, and avoiding the reduction of data accuracy at the edge of the spherical distribution due to other methods not matching the spherical distribution method, or even the reduction of data accuracy near the center.

[0042] Step S3: The analysis management unit analyzes the subsequent first data packet in real time and determines the first distance between the first data packet and the center; when the first distance is greater than a first threshold, the analysis management unit does not allow the user terminal corresponding to the first data packet to access the target data; when the first distance is less than the first threshold, the analysis management unit further determines whether the first distance is less than a second threshold; when the first distance is greater than the second threshold, the analysis management unit does not allow the user terminal to access the target data; when the first distance is less than the second threshold, the analysis management unit sends a call message to the user terminal; the first threshold is more than twice the second threshold; in this step, when the first distance is greater than the first threshold, the first data is at the edge of the spherical distribution and is significantly different from the normal data near the center, which is abnormal data. At this time, the user terminal corresponding to the first data packet is prevented from accessing the target data. The first distance is first preliminarily compared with the first threshold. When the first distance is less than the first threshold, the user terminal corresponding to the first data may have the authority to access the target data. Based on the zero trust mechanism, it is necessary to further determine the authority of the user terminal, and then further determine the authority of the user terminal. Step 14 determines whether the first distance is less than a second threshold. To accurately determine the permissions of the user terminal, the user terminal's access is still blocked when the first distance is greater than the second threshold. When the distance is less than the second threshold, the analysis and management unit sends a call message to the user terminal. To accurately detect the user terminal's access permissions, further determination is required in combination with the user information of the user terminal. Normal behavior information of the user terminal can be obtained by analyzing the length information, content information, and access address of the data packet of the user information. For example, by analyzing the length information, access address, and content information of the data packet through a communication protocol, the integrity of the data packet can be determined and a record of its access to the target data can be obtained. The user information is added to the first data packet to obtain a second data packet, and a second distance from the second data packet to the center is determined. The greater the second distance, the fewer or even no successful accesses to the target data by the user terminal. Based on the zero-trust network, it can be determined that the user terminal does not have access permissions to the target data. The smaller the second distance, the more successful accesses to the target data by the user terminal. Therefore, it can be determined that the target data has access permissions.

[0043] Step S4: The user terminal receives the call information, and the user of the user terminal determines whether to send the user information to the analysis management unit based on the call information; in this step, the user can choose to send or not send the user information to the analysis management unit based on the call information. Specifically, when the user no longer wants to access the target data, he can choose not to send the user information. The analysis management unit does not receive the user information within a predetermined time and does not allow the user terminal to access the target data; when the user has an urgent need to access the target data, he can choose to send the user information. The analysis management unit receives the user information within a predetermined time, adds the user information to the first data packet, and obtains the second data packet for further judgment. During this period, the network management device does not need to re-authorize the user terminal, and the analysis management unit can automatically judge the user terminal's access rights to the target data based on the user information.

[0044] Among them, the ratio of the second threshold value to the fixed radius is k, and the range of k is more than one third and less than one half. In this step, when selecting the second threshold value, since the data distribution is more sparse the farther away from the center, the data distribution is relatively sparse within a range greater than one half of the fixed radius r, and the accuracy of judging the user-side authority corresponding to the data is low. Based on the zero trust mechanism of the network, the second threshold value should be selected from a range less than one half of the fixed radius; since the data distribution is denser the closer to the center, within a range less than one third of the fixed radius r, although the accuracy of judging the user-side authority corresponding to the data here is high, since the range only occupies one twenty-seventh of the spherical distribution, it is easy to miss nearby data that can also judge the corresponding user-side authority with high accuracy, so the second threshold value should be selected from a range greater than one third of the fixed radius; in summary, the ratio range of the second threshold value to the fixed radius is more than one third and less than one half, which is accurate. Further, the step S2 includes:

[0045] Step S21: The analysis management unit detects data packets in the network in real time;

[0046] Step S22: The analysis management unit analyzes the data packet using a mean shift algorithm, and the mean shift algorithm is based on a circular sliding window for shifting. In this step, the radius of the circular sliding window is a fixed radius r. If a variable radius is selected for the circular sliding window, when the radius is large, the data is more dispersed and the mean of the circular sliding window is taken, the position of the mean is not located in the area with the highest data density of the circular sliding window. When the radius is small, the data is more densely distributed, but the circular sliding window contains less data and the data is more densely distributed. Due to the small number, the mean of the circular sliding window cannot represent the true distribution of the entire data. Therefore, the circular sliding window adopts a fixed radius r to both contain enough data and ensure data convergence.

[0047] Step S23: Obtaining a spherical distribution of data through the analysis management unit, wherein the spherical distribution matches the circular sliding window. In this step, the analysis management unit continuously iterates based on the multiple circular sliding windows to form the spherical distribution. The circular sliding window with a fixed radius r can better match the spherical distribution, making the obtained spherical distribution data more accurate, further improving the accuracy of zero-trust data, and avoiding the reduction of data accuracy at the edge of the spherical distribution due to the mismatch between other methods and the spherical distribution method, and even reducing the accuracy of data near the center.

[0048] Step S24: The analysis management unit obtains the center of the spherical distribution according to the spherical distribution, where the center is the center of the set with the highest data density of the spherical distribution.

[0049] Specifically, the analysis management unit adopts a mean shift algorithm to analyze the data packet, starting from a circular sliding window centered at a random point, and the circular sliding window continuously slides toward the area with higher data density, and the center of the circular sliding window moves to the average value of the data within the circular sliding window. Multiple circular sliding windows are continuously iterated to form the spherical distribution, and the mean of the data in the area with the highest data density of the spherical distribution is the center of the spherical distribution. The highest set can preferably be data in the area smaller than half of the fixed radius r within the spherical distribution.

[0050] Furthermore, in step S2, the spherical distribution is obtained by the following formula:

[0051]

[0052] Where t is the center of the spherical distribution, t iis the quantized value of the i-th data packet after analysis by the analysis management unit, m is the number of data packets within the radius r, s is the negative derivative of the kernel function in the mean shift algorithm, y r (t) is the shifted mean of t, where k is half. The mean shift algorithm can automatically discover the number of clusters, which is also an advantage of the mean algorithm. The center of the spherical points converges to the maximum density area, which can accurately reflect the distribution of data and accurately filter out abnormal data, thereby ensuring accurate detection of user-side permissions.

[0053] Furthermore, the step S4 further includes a step S5:

[0054] The analysis management unit receives the user information and adds the user information to the first data packet to form a second data packet. The analysis management unit analyzes the second data packet and again determines a second distance from the center. In this step, since the second data packet contains the user information, and the user information includes a record of the user terminal accessing the target data, the second data packet can accurately reflect the access rights of the user terminal. The second distance obtained by the analysis unit is compared with a third threshold. When the second distance is greater than the third threshold, the user terminal is not allowed to access the target data. Exemplarily, when the record of the user terminal accessing the target data is zero, the analysis management unit, when analyzing the second data packet, will determine that the second data packet deviates farther from the center, indicating abnormal data, and the second distance is larger. In this case, the user terminal is not allowed to access the target data. When the second distance is less than the third threshold, the user terminal is allowed to access the target data. Exemplarily, when the record of the user terminal accessing the target data is not zero, it indicates that the user terminal has the right to access the target data. When the analysis management unit analyzes the second data packet, it will determine that the second data packet deviates closer to the center, indicating normal data, and the second distance is smaller. Therefore, the user terminal is allowed to access the target data.

[0055] Furthermore, the step S5 further includes a step S6:

[0056] When the second distance is greater than a third threshold, the analysis and management unit does not allow the user terminal to access the target data. When the second distance is less than the third threshold, the analysis and management unit allows the user terminal to access the target data. The second threshold is more than twice the third threshold. In this step, because the second data packet contains the user information that can accurately determine the user terminal's authority to access the target data, it is necessary to compare the second distance with a range smaller than the second threshold. Therefore, the third threshold, which is less than half of the second threshold, is selected for comparison with the second distance to further improve the accuracy of determining the user terminal's authority, thereby ensuring network data security.

[0057] Furthermore, the user information includes user-related information stored by the user terminal, and the related information includes historical data of the user, and the historical data includes a collection of data packets sent by the user terminal within a predetermined time. The normal behavior information of the user is obtained through the length information, content information and access address information of the data packet, and the user information is added to the first data packet to form the second data packet. The analysis and management unit analyzes the second data packet and determines the access rights of the user terminal again. By analyzing the length information, access address and content information of the data packet through communication protocol and content, the integrity of the data packet can be determined and the record of the user terminal accessing the target data can be obtained. The record can more accurately confirm the access rights of the user terminal. Furthermore, the present invention also provides a network data security detection system based on zero trust, and the system includes:

[0058] The logic storage unit is used to store the network data security detection logic of the network management equipment;

[0059] A network management device, comprising an analysis management unit, wherein the network management device is configured to: save the pre-set detection logic of the network data security to the logic storage unit;

[0060] The analysis management unit is configured to: establish a data distribution, use a fixed radius r as a sliding window to perform mean shift analysis and obtain the center of the spherical distribution; the analysis management unit analyzes a subsequent first data packet and determines a first distance from the center; when the first distance is greater than a first threshold, the analysis management unit does not allow the user terminal corresponding to the first data packet to access the target data; when the first distance is less than the first threshold, further determine whether the first distance is less than a second threshold; when the first distance is greater than the second threshold, the analysis management unit does not allow the user terminal to access the target data; when the first distance is less than the second threshold, the analysis management unit sends a call message to the user; the first threshold is more than twice the second threshold;

[0061] The user terminal is configured to: receive the call information, and the user of the user terminal determines whether to send user information to the network management device based on the call information;

[0062] The ratio of the second threshold to the fixed radius is k, and the range of k is greater than one third and less than one half.

[0063] Furthermore, the analysis and management unit is also configured to: detect data packets in the network in real time, analyze the data packets using a mean shift algorithm, and obtain a spherical distribution of the data, wherein the mean shift algorithm is based on a circular sliding window for shifting, the spherical distribution matches the circular sliding window, and the center of the spherical distribution is obtained based on the spherical distribution, and the center is the center of the set with the highest data density.

[0064] Furthermore, the spherical distribution is obtained by the following formula:

[0065]

[0066] Where t is the center of the spherical distribution, t i is the quantized value of the i-th data packet after analysis by the analysis management unit, m is the number of data packets within the radius r, s is the negative derivative of the kernel function in the mean shift algorithm, y r (t) is the shifted mean of t, where k is one-half.

[0067] Furthermore, the analysis management unit is further configured to: receive the user information, add the user information to the first data packet to form a second data packet, the analysis management unit analyzes the second data packet, and again determines a second distance from the center; when the second distance is greater than a third threshold, the analysis management unit does not allow the user terminal to access the target data; when the second distance is less than the third threshold, the analysis management unit allows the user terminal to access the target data, and the second threshold is more than twice the third threshold;

[0068] The user information includes user-related information stored by the user terminal, the related information includes the user's historical data, the historical data includes a collection of data packets sent by the user terminal within a predetermined time, and the data packets include data packet length information, content information and access address information.

[0069] In summary, the technical solution of the present invention integrates the analysis management unit into the network management device in a zero-trust network, not only directly detecting the access rights of the user terminal corresponding to the data packet according to the detection logic in the network management device, but also further confirming the access rights of the user terminal by analyzing the data packet. Through the mutual cooperation between the network management device and the analysis unit, the access rights of the user terminal can be confirmed more accurately. The circular sliding window with a fixed radius r set in the mean shift algorithm can better match the spherical distribution, making the obtained spherical distribution data more accurate, improving the accuracy of zero-trust data, and avoiding the reduction of data accuracy at the edge of the edge spherical distribution due to other methods not matching the spherical distribution method, or even reducing the accuracy of data near the center. At the same time, when the first distance between the first data packet and the center is less than a second threshold, user information is added to the first data packet to obtain a second data packet. The length information, access address and content information of the data packet can be analyzed through the communication protocol to determine the integrity of the data packet and obtain the record of its access to the target data. Through the combined effect of the above technical solutions, the access rights of the user terminal can be accurately determined, thereby ensuring the security of network data.

[0070] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] The above embodiments merely represent several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be based on the appended claims.

[0072] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network data security detection method based on zero trust, characterized in that: The steps include: Step S1: The network management device saves the pre-set network data security detection logic to the logic storage unit; Step S2: The network management device is integrated with an analysis management unit, which establishes data distribution and uses a fixed radius r as a sliding window to perform mean shift analysis to obtain the center of the spherical distribution of the data packet; Step S3: The analysis management unit analyzes the subsequent first data packet in real time and determines a first distance between the first data packet and the center; when the first distance is greater than a first threshold, the analysis management unit does not allow the user terminal corresponding to the first data packet to access the target data; when the first distance is less than the first threshold, the analysis management unit further determines whether the first distance is less than a second threshold; when the first distance is greater than the second threshold, the analysis management unit does not allow the user terminal to access the target data; when the first distance is less than the second threshold, the analysis management unit sends a call message to the user terminal; wherein the first threshold is more than twice the second threshold; Step S4: the user terminal receives the call information, and the user of the user terminal determines whether to send user information to the analysis management unit based on the call information; The ratio of the second threshold to the fixed radius is k, and the value range of k is greater than one third and less than one half.

2. A zero-trust based network data security detection method according to claim 1, characterized in that: The step S2 comprises: Step S21: The analysis management unit detects data packets in the network in real time; Step S22: the analysis management unit analyzes the data packet using a mean shift algorithm, wherein the mean shift algorithm performs shifting based on a circular sliding window with a fixed radius r; Step S23: obtaining a spherical distribution of the data packets through the analysis management unit, wherein the spherical distribution matches the circular sliding window; Step S24: The analysis management unit obtains the center of the spherical distribution according to the spherical distribution, where the center is the center of the set with the highest data density of the spherical distribution.

3. A zero-trust based network data security detection method according to claim 2, characterized in that: In step S2, the spherical distribution is obtained by the following formula: Where t is the center of the spherical distribution, t i is the quantized value of the i-th data packet after analysis by the analysis management unit, m is the number of data packets within the radius r, s is the negative derivative of the kernel function in the mean shift algorithm, y r (t) is the shifted mean of t, where k is one-half.

4. A zero-trust based network data security detection method according to claim 1, characterized in that: The step S4 further includes a step S5: The analysis management unit receives the user information, adds the user information to the first data packet to form a second data packet, analyzes the second data packet, and again determines a second distance between the second data packet and the center.

5. A zero-trust based network data security detection method according to claim 4, characterized in that: The step S5 further includes a step S6: When the second distance is greater than a third threshold, the analysis management unit does not allow the user terminal to access the target data; when the second distance is less than the third threshold, the analysis management unit allows the user terminal to access the target data, and the second threshold is more than twice the third threshold.

6. A zero-trust based network data security detection method according to claim 1, characterized in that: The user information includes user-related information stored by the user terminal, the related information includes historical data of the user, the historical data includes a collection of data packets sent by the user terminal within a predetermined time, and the data packets include length information, content information and access address information of the data packets.

7. A zero-trust-based network data security detection system, the system being based on a zero-trust-based network data security detection method according to any one of claims 1 to 6, characterized in that: The system comprises: The logic storage unit is used to store the network data security detection logic of the network management equipment; A network management device integrated with an analysis and management unit, configured to store the pre-set network data security detection logic in the logic storage unit; The analysis management unit is configured to: establish a data distribution, use a fixed radius r as a sliding window to perform mean shift analysis and obtain the center of the spherical distribution; the analysis management unit analyzes a subsequent first data packet and determines a first distance from the center; when the first distance is greater than a first threshold, the analysis management unit does not allow the user terminal corresponding to the first data packet to access the target data; when the first distance is less than the first threshold, further determine whether the first distance is less than a second threshold; when the first distance is greater than the second threshold, the analysis management unit does not allow the user terminal to access the target data; when the first distance is less than the second threshold, the analysis management unit sends a call message to the user; the first threshold is more than twice the second threshold; The user terminal is configured to: receive the call information, and the user of the user terminal determines whether to send user information to the analysis management unit based on the call information; The ratio of the second threshold to the fixed radius is k, and the range of k is greater than one third and less than one half.

8. A zero-trust based network data security detection system according to claim 7, characterized in that: The analysis and management unit is further configured to: detect data packets in the network in real time, analyze the data packets using a mean shift algorithm, and obtain a spherical distribution of the data, wherein the mean shift algorithm is based on a circular sliding window for shifting, the spherical distribution matches the circular sliding window, and the center of the spherical distribution is obtained based on the spherical distribution, wherein the center is the center of the set with the highest data density of the spherical distribution.

9. A zero-trust based network data security detection system according to claim 8, characterized in that: The spherical distribution is obtained by the following formula: Where t is the center of the spherical distribution, t i is the quantized value of the i-th data packet after analysis by the analysis management unit, m is the number of data packets within the radius r, s is the negative derivative of the kernel function in the mean shift algorithm, y r (t) is the shifted mean of t, where k is one-half.

10. A zero-trust based network data security detection system according to claim 7, characterized in that: The analysis management unit is further configured to: receive the user information, add the user information to the first data packet to form a second data packet, analyze the second data packet, and again determine a second distance from the center; when the second distance is greater than a third threshold, the analysis management unit does not allow the user terminal to access the target data; when the second distance is less than the third threshold, the analysis management unit allows the user terminal to access the target data, and the second threshold is more than twice the third threshold; The user information includes user-related information stored by the user terminal, the related information includes the user's historical data, the historical data includes a collection of data packets sent by the user terminal within a predetermined time, and the data packets include data packet length information, content information and access address information.

Images