A government affairs information security and resource sharing system based on big data

Abstract

The present invention discloses a government affairs information security and resource sharing system based on big data, belonging to the field of data security and sharing, and solves the problem of how to achieve government affairs information security while realizing resource sharing; through the data screening module to screen government affairs data, it can ensure that the government affairs data uploaded to the private network database or the public database is secure data, and ensure that the non-disclosable government affairs data can be stored in the private network; through the access analysis module to analyze the access request data packet, it can conduct targeted access security management on the private network database and the public database, so that the non-disclosable government affairs data stored in the private network database can avoid the intrusion of the threat source IP address, and in combination with the authorized address database, the internal personnel of the government affairs department can achieve resource sharing; so that the public database can ensure that it will not crash due to a large number of accesses when it is made publicly available, and avoid its data security problems.

Description

Technical Field

[0001] The present invention belongs to the field of data security and sharing, and specifically relates to a government information security and resource sharing system based on big data. Background Art

[0002] With the development of Internet technology and the in-depth construction of big data, relevant departments have achieved the resource sharing of government information, which has brought great convenience to individuals, units and enterprises.

[0003] While realizing the resource sharing of government information, it will inevitably bring certain hidden dangers to the security of government information. At present, firewalls are used for physical isolation, but to achieve resource sharing, information interaction will inevitably occur. How to achieve the security of government information while realizing resource sharing is an urgent problem to be solved. For this reason, the present invention proposes a government information security and resource sharing system based on big data. Summary of the Invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art. For this reason, the present invention proposes a government information security and resource sharing system based on big data, which solves the technical problem of how to achieve the security of government information while realizing resource sharing.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A government information security and resource sharing system based on big data, comprising:

[0007] A data acquisition module for acquiring government data;

[0008] A data screening module for screening the acquired government data, outputting government data with data feature types of publicly available and non-publicly available, and uploading them to a public database and a private network database respectively;

[0009] An access analysis module for analyzing access request data packets sent to the private network database or the public database; including: judging whether the source IP address of the access request data packet sent to the private network database is a threat source IP address, outputting a signal for blocking or not blocking the access request data packet received from the current source IP address, and sending it to the private network database; and calculating the average access value of the public database within a corresponding time period, outputting a signal for restricting or not restricting the subsequent source IP address from accessing, and sending it to the public database.

[0010] Further, the government data includes internal data and external data. The internal data refers to the government data obtained through the government private network, and the external data refers to the government data obtained through the public network.

[0011] Furthermore, the process of the data screening module screening government affairs data is as follows:

[0012] Step S1: Conduct risk analysis on the obtained government affairs data; compare the obtained government affairs data with the virus data in the virus database. If the obtained government affairs data is consistent with the virus data, the government affairs data is cleared, and a prompt signal indicating data acquisition failure is returned to the data acquisition module; otherwise, proceed to the next step; the virus database is updated regularly.

[0013] Step S2: Preprocess the risk-free government affairs data;

[0014] Step S3: Conduct feature analysis on the preprocessed government affairs data and output the data feature type of the government affairs data; convert the government affairs data into text data, and input the text data into the feature recognition model to output whether the corresponding text data is public or not; the feature recognition model is a neural network model constructed by training and testing on publicly available text data samples and non-public text data of government departments in the early stage.

[0015] Step S4: Classify the government affairs data according to the data feature type, upload the government affairs data with the data feature type of public to the public database, and upload the government affairs data with the data feature type of non-public to the private network database.

[0016] Furthermore, the preprocessing process includes data cleaning, data integration, data transformation, and data reduction.

[0017] Furthermore, the government affairs data is multi-source heterogeneous data, and the data types include text type, image type, sound type, and video type; for the government affairs data of image type and video type, text content extraction is carried out through digital image technology and computer vision technology; the voice data included in the sound type and video type is subjected to text content extraction through voice technology.

[0018] Furthermore, the process of the access analysis module analyzing the access request data packet sent to the public database or the private network database is as follows:

[0019] Step P1: Parse the obtained access request data packet to obtain the source IP address and the database address being accessed; judge the type of the database to be accessed according to the database address;

[0020] If the accessed database is a private network database, compare the current source IP address with the threat source IP addresses stored in the threat address database. If the comparison is successful, generate a signal to block the access request data packet of the current source IP address and send it to the private network database; if the comparison is unsuccessful, go to Step P2;

[0021] If the accessed database is a public database, go to step P3;

[0022] Step P2: Match the source IP address of the obtained access request data packet with the authorized source IP addresses stored in the authorized address database;

[0023] If they match, generate a signal allowing the current source IP address to connect to the e-government data address at the corresponding browsing level and send it to the private network database;

[0024] If they do not match, mark the current source IP address as a suspicious source IP address, and count the total number of access request data packets sent by the same suspicious source IP address, NZi, within a unit time period, as well as the time interval TZij between each sending of an access request data packet and the previous sending; where i represents the detailed IP address of the suspicious source IP address, and j represents the number of times the user terminal of the same suspicious source IP address sends an access request data packet, j = 1, 2... j;

[0025] According to the calculation formula , obtain the access request value of the suspicious source IP address with source IP address i to the private network database; in the formula, a1 and a2 are preset proportionality coefficients, and a1 is less than a2; if the access request value of the same suspicious source IP address to the private network database within a unit time period is greater than or equal to the preset access request threshold, mark the suspicious source IP address as a threat source IP address and store it in the threat address database;

[0026] Step P3: Count the number m of source IP addresses that send access request data packets to the public database within the time period (t1, t2), the number of times Ch that the same source IP address accesses the public database, and the interval access duration Shk of the same source IP address; where h represents the number of the source IP address accessing the public database, h = 1, 2... m; k represents the number of times the same source IP address accesses the public database; k = 1, 2... g; g represents the total number of times the same source IP address accesses the public database within the time period (t1, t2);

[0027] According to the calculation formula , obtain the average access value of the public database within the time period (t1, t2) ; in the formula, γ is a preset proportionality coefficient, and 0 < γ < 1;

[0028] When there is greater than or equal to the average access upper limit value within the time period (t1, t2), generate a signal restricting subsequent source IP addresses from accessing and send it to the public database;

[0029] When there is If it is less than the average access upper limit value, a signal allowing subsequent source IP addresses to access is generated and sent to the public database.

[0030] Furthermore, the authorized address database is used to store the source IP addresses that can access the private network database; and the authorized address database also marks and classifies the source IP addresses according to different browsing levels for storage.

[0031] Compared with the prior art, the beneficial effects of the present invention are:

[0032] 1. The present invention screens the obtained government affairs data through a data screening module, including performing government affairs analysis on the government affairs data and classifying the data feature types of the government affairs data, and outputs the government affairs data with data feature types of publicly available and non-publicly available, and uploads them to the public database and the private network database respectively; it can ensure that the government affairs data uploaded to the private network database or the public database is secure data, and ensure that the non-publicly available government affairs data can be stored in the private network;

[0033] 2. The present invention determines whether the source IP address of the access request data packet sent to the private network database is a threat source IP address through an access analysis module, outputs a signal indicating whether to block the access request data packet of the current source IP address, and sends it to the private network database; and calculates the average access value of the public database within a corresponding time period, outputs a signal indicating whether to limit the access of subsequent source IP addresses, and sends it to the public database; it can perform targeted access security management on the private network database and the public database, so that the non-publicly available government affairs data stored in the private network database can avoid the intrusion of threat source IP addresses, and in combination with the authorized address database, enable internal personnel of government affairs departments to achieve resource sharing; in addition, it also enables the public database to ensure that it will not collapse due to a large number of accesses when realizing external disclosure, and to a certain extent, also avoids the data security problems of the data stored in it. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0035] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0036] Such as Figure 1As shown in the figure, a government affairs information security and resource sharing system based on big data includes: a data acquisition module, a data screening module, an access analysis module, a private network database, a public database, and an authorized address database;

[0037] The data acquisition module is used to acquire government affairs data, where the government affairs data includes internal data and external data. It can be understood that internal data refers to government affairs data obtained through the government affairs private network, and external data refers to government affairs data obtained through the public network;

[0038] The data screening module is used to screen the acquired government affairs data;

[0039] In this embodiment, there are two types of data feature types, one is publicly available and the other is not publicly available;

[0040] The process of the data screening module screening the government affairs data is as follows:

[0041] Step S1: Conduct risk analysis on the acquired government affairs data;

[0042] That is, compare the acquired government affairs data with the virus data in the virus database. If the acquired government affairs data is the same as the virus data, clear the government affairs data and return a prompt signal of data acquisition failure to the data acquisition module; otherwise, proceed to the next step; where the virus database is updated regularly;

[0043] Step S2: Preprocess the government affairs data without risk;

[0044] The preprocessing process includes data cleaning, data integration, data transformation, and data reduction, etc.;

[0045] Step S3: Conduct feature analysis on the preprocessed government affairs data and output the data feature type of the government affairs data;

[0046] Convert the government affairs data into text data and input the text data into the feature recognition model to output whether the corresponding text data is publicly available or not;

[0047] Among them, the government affairs data is multi-source heterogeneous data, including various data types, which can be text type, image type, sound type, video type, etc.;

[0048] Among them, for government affairs data of image type and video type, text content extraction can be carried out through digital image technology and computer vision technology; the voice data included in the sound type and video type can all be carried out text content extraction through voice technology; this technology is an existing technology and will not be elaborated here;

[0049] Optionally, the feature recognition model is a neural network model constructed through pre - training and testing on publicly available text data samples and non - publicly available text data of government departments;

[0050] Step S4: Classify government affairs data according to the data feature type, upload the government affairs data with the data feature type of public to the public database, and upload the government affairs data with the data feature type of non - public to the private network database;

[0051] The data screening module can ensure that the government affairs data uploaded to the private network database or the public database is secure data, and ensure that non - publicly available government affairs data can be stored in the private network;

[0052] The access analysis module is used to analyze the access request data packets sent to the public database or the private network database; the specific analysis process is as follows:

[0053] Step P1: Parse the obtained access request data packet to obtain the source IP address and the accessed database address;

[0054] Judge the type of the database to be accessed according to the database address. As mentioned above, the database types include the public database and the private network database. The public database is a database that can be accessed by the public network, while the private network database is a database that can only be accessed by the private network of government departments;

[0055] If the accessed database is the private network database, compare the current source IP address with the threat source IP addresses stored in the threat address database. If the comparison is successful, generate a signal to block the access request data packet of the current source IP address and send it to the private network database, which can directly clear the access request data packets sent by the source IP addresses that may cause information hidden dangers in the private network database at the data packet receiving source, isolate the information security risk in a timely manner, and also save the subsequent re - analysis of the threat source IP addresses, improving the data analysis and processing efficiency of the access analysis module; if the comparison is unsuccessful, go to step P2;

[0056] If the accessed database is the public database, go to step P3;

[0057] Step P2: Match the source IP address of the obtained access request data packet with the authorized source IP addresses stored in the authorized address database;

[0058] It should be noted that the authorized address database is used to store the source IP addresses that can access the private network database; further, the authorized address database also marks and classifies the source IP addresses according to different browsing levels and stores them;

[0059] When the obtained source IP address matches the authorized source IP address in the authorized address database, the access analysis module generates a signal allowing the current source IP address to connect to the e-government data address at the corresponding browsing level and sends it to the private network database;

[0060] When the obtained source IP address does not match the authorized source IP address in the authorized address database, the access analysis module marks the current source IP address as a suspicious source IP address, and counts the total number NZi of access request packets sent by the client of the same suspicious source IP address within a unit time period, as well as the interval time TZij between each sending of an access request packet and the previous sending, and this interval time is calculated in seconds; where i represents the detailed IP address of the suspicious source IP address, and j represents the number of times the client of the same suspicious source IP address sends an access request packet, j = 1, 2... j; where the unit time period is specified according to the actual situation and can be one hour, one day, etc.;

[0061] According to the calculation formula , obtain the access request value of the suspicious source IP address with source IP address i to the private network database; in the formula, a1 and a2 are preset proportionality coefficients, and a1 is less than a2;

[0062] If the access request value of the same suspicious source IP address to the private network database within the unit time period is greater than or equal to the preset access request threshold, then mark this suspicious source IP address as a threat source IP address and store it in the threat address database;

[0063] Step P3: Count the number m of source IP addresses that send access request packets to the public database within the time period (t1, t2), the number Ch of times the same source IP address accesses the public database, and the interval access duration Shk of the same source IP address; where h represents the number of the source IP address accessing the public database, h = 1, 2... m; k represents the number of times the same source IP address accesses the public database, k = 1, 2... g; g represents the total number of times the same source IP address accesses the public database within the time period (t1, t2);

[0064] According to the calculation formula , obtain the average access value of the public database within the time period (t1, t2) ; in the formula, γ is a preset proportionality coefficient, and 0 < γ < 1; optionally, the units of t1 and t2 can be seconds, minutes or hours;

[0065] When there appears greater than or equal to the average access upper limit value within the time period (t1, t2), the access analysis module generates a signal restricting subsequent source IP addresses from accessing and sends it to the public database; thus preventing abnormal source IP addresses from accessing the public database and causing the public database to crash;

[0066] When it appears within the time period (t1, t2) less than the average access upper limit value, the access analysis module generates a signal allowing subsequent source IP addresses to access and sends it to the public database;

[0067] In this embodiment, through the access analysis module, targeted access security management can be carried out on the private network database and the public database, so that the non-disclosable government affairs data stored in the private network database can avoid intrusion by threat source IP addresses, and in combination with the authorized address database, internal personnel in the government affairs department can achieve resource sharing; in addition, it also enables the public database to ensure that it will not crash due to a large number of accesses when it is made publicly available, and to a certain extent, it also avoids the data security problems of the data stored in it.

[0068] The above formulas are all calculated by removing the dimension and taking their numerical values. The formula is a formula obtained by collecting a large amount of data and performing software simulation to obtain the one closest to the actual situation. The preset parameters and preset thresholds in the formula are set by those skilled in the art according to the actual situation or obtained by simulating a large amount of data.

[0069] The working principle of the present invention:

[0070] The present invention obtains government affairs data through the data acquisition module; screens the obtained government affairs data through the data screening module, outputs the government affairs data with the data feature type of publicly available and non-disclosable government affairs data, and uploads them to the public database and the private network database respectively; analyzes the access request data packets sent to the private network database or the public database through the access analysis module; including: judging whether the source IP address of the access request data packet sent to the private network database is a threat source IP address, outputting a signal whether to block the access request data packet of the current source IP address, and sending it to the private network database; and calculating the average access value of the public database within the corresponding time period, outputting a signal whether to limit the access of subsequent source IP addresses, and sending it to the public database.

[0071] In the embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation; the modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the method of this embodiment.

[0072] The above embodiments are only used to illustrate the technical method of the present invention and not to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical method of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A government affairs information security and resource sharing system based on big data, characterized in that: A data acquisition module for acquiring government affairs data; A data screening module for screening the acquired government affairs data, outputting government affairs data with data feature types of publicly available and non-publicly available, and uploading them to a public database and a private network database respectively; An access analysis module for analyzing access request data packets sent to the private network database or the public database; including: judging whether the source IP address of the access request data packet sent to the private network database is a threat source IP address, outputting a signal indicating whether to block the access request data packet received from the current source IP address, and sending it to the private network database; and if accessing the public database, calculating the average access value of the public database within a corresponding time period, outputting a signal indicating whether to restrict the access of subsequent source IP addresses, and sending it to the public database; the analysis process is as follows: Step P1: Parse the acquired access request data packet to obtain the source IP address and the accessed database address; judge the type of database to be accessed according to the database address; If accessing the private network database, compare the current source IP address with the threat source IP addresses stored in the threat address database. If the comparison is successful, generate a signal to block the access request data packet received from the current source IP address and send it to the private network database; if the comparison is unsuccessful, go to step P2; Step P2: Match the source IP address of the acquired access request data packet with the authorized source IP addresses stored in the authorized address database; If the match is successful, generate a signal allowing the current source IP address to connect to the government affairs data address at the corresponding browsing level and send it to the private network database; If the match is unsuccessful, mark the current source IP address as a suspicious source IP address, and count the total number of access request data packets sent by the same suspicious source IP address NZi within a unit time period, as well as the interval time TZij between each sending of the access request data packet and the previous sending; where i represents the detailed IP address of the suspicious source IP address, and j represents the number of times the user terminal of the same suspicious source IP address sends the access request data packet, j = 1, 2... j; According to the calculation formula , obtain the access request value of the suspicious source IP address with the source IP address i to the private network database; where a1 and a2 are preset proportionality coefficients, and a1 is less than a2; if the access request value of the same suspicious source IP address to the private network database within a unit time period is greater than or equal to the preset access request threshold, then mark the suspicious source IP address as a threat source IP address and store it in the threat address database.

2. The government affairs information security and resource sharing system based on big data according to claim 1, wherein: Government affairs data includes internal data and external data. Internal data refers to government affairs data obtained through the government affairs private network, and external data refers to government affairs data obtained through the public network.

3. A government affairs information security and resource sharing system based on big data according to claim 1, characterized in that: The process of the data screening module screening the government affairs data is as follows: Step S1: Conduct a risk analysis on the acquired government affairs data; compare the acquired government affairs data with the virus data in the virus database. If the acquired government affairs data is the same as the virus data, clear the government affairs data and return a prompt signal of data acquisition failure to the data acquisition module; otherwise, proceed to the next step; the virus database is updated regularly; Step S2: Preprocess the government affairs data without risk; Step S3: Conduct feature analysis on the preprocessed government affairs data, and output the data feature types of the government affairs data; convert the government affairs data into text data, and input the text data into the feature recognition model to output whether the corresponding text data is public or not; the feature recognition model is a neural network model constructed through training and testing on publicly available text data samples and non-public text data of government departments in the early stage. Step S4: Classify the government affairs data according to the data feature types, upload the government affairs data with the data feature type of public to the public database, and upload the government affairs data with the data feature type of non-public to the private network database.

4. A government affairs information security and resource sharing system based on big data according to claim 3, characterized in that: The preprocessing process includes data cleaning, data integration, data transformation, and data reduction.

5. The government affairs information security and resource sharing system based on big data according to claim 3, characterized in that: The government affairs data is multi-source heterogeneous data, and the data types include text type, image type, sound type, and video type; for the government affairs data of image type and video type, text content extraction is carried out through digital image technology and computer vision technology; the sound data included in the sound type and video type is subjected to text content extraction through speech technology.

6. A government affairs information security and resource sharing system based on big data according to claim 1, characterized in that: The process of the access analysis module analyzing the access request data packet sent to the public database or the private network database further includes: If the public database is accessed, go to step P3; Step P3: Count the number m of source IP addresses that send access request data packets to the public database within the time period (t1, t2), the number of times Ch that the same source IP address accesses the public database, and the interval access duration Shk of the same source IP address; where h represents the number of the source IP address accessing the public database, h = 1, 2... m; k represents the number of times the same source IP address accesses the public database, k = 1, 2... g; g represents the total number of times the same source IP address accesses the public database within the time period (t1, t2). According to the calculation formula , obtain the average access value of the public database within the time period (t1, t2) ; where γ is a preset proportionality coefficient, and 0 < γ < 1; When it appears within the time period (t1, t2) is greater than or equal to the average access upper limit value, a signal for restricting the access of subsequent source IP addresses is generated and sent to the common database; When it appears within the time period (t1, t2) less than the average access upper limit value, a signal allowing subsequent source IP addresses to access is generated and sent to the common database.

7. A government affairs information security and resource sharing system based on big data according to claim 1, characterized in that: The authorized address database is used to store the source IP addresses that can access the private network database. And the authorized address database also marks and classifies and stores the source IP addresses according to different browsing levels.

Images