Internet security risk analysis method based on big data analysis technology

Abstract

The present application relates to the field of Internet security risk analysis, and specifically discloses an Internet security risk analysis method based on big data analysis technology, which first obtains security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally uses a classifier to obtain a security risk prediction classification level, thereby achieving real-time security risk prediction and response, which helps to timely discover and respond to potential threats, and then adapt to the ever-changing network security environment.

Description

Technical Field

[0001] The present application relates to the field of Internet security risk analysis, and more specifically, to an Internet security risk analysis method based on big data analysis technology. Background Art

[0002] The Internet is a global network interconnection system that enables billions of devices around the world to communicate and exchange information with each other through the use of standardized communication protocols. It provides people with unlimited information resources, social interaction, online entertainment, e-commerce and other services and applications, profoundly changing all aspects of human society and becoming an indispensable and important infrastructure in modern society.

[0003] Internet security risks refer to various threats and vulnerabilities in the network environment, including but not limited to network attacks, malware, data leakage, identity theft, etc., which may lead to serious consequences such as personal privacy leakage, property loss, information leakage, etc., and have a serious impact on individuals, organizations and even the entire society. Considering that traditional security analysis methods are usually based on static rules or manual analysis, they cannot detect new threats and attacks in a timely manner.

[0004] Therefore, an Internet security risk analysis method based on big data analysis technology is desired. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. The embodiment of this application provides an Internet security risk analysis method based on big data analysis technology, which first obtains security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally uses a classifier to obtain a security risk prediction classification level, thereby achieving real-time security risk prediction and response, which helps to timely discover and respond to potential threats, and then adapt to the ever-changing network security environment.

[0006] According to one aspect of the present application, there is provided an Internet security risk analysis method based on big data analysis technology, which includes:

[0007] Obtain security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources;

[0008] Extracting a security risk sample information semantic feature vector and an Internet operation log analysis feature vector from the security risk sample data collected by the big data and the Internet operation log analysis data collected from the Internet data source;

[0009] Based on the security risk sample information semantic feature vector and the Internet operation log analysis feature vector, a security risk prediction classification level is obtained.

[0010] Compared with the prior art, the present application provides an Internet security risk analysis method based on big data analysis technology, which first obtains security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally uses a classifier to obtain a security risk prediction classification level, thereby realizing real-time security risk prediction and response, which helps to timely discover and respond to potential threats, and thus adapt to the ever-changing network security environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0012] Figure 1 The present invention is a flowchart of an Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application.

[0013] Figure 2 The present invention is a flowchart of performing feature extraction on the security risk sample data collected by big data to obtain the semantic feature vector of the security risk sample information in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application.

[0014] Figure 3 The present invention is a flowchart of performing feature extraction on the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis feature vector in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application.

[0015] Figure 4 The present invention is a flowchart of performing data preprocessing on the Internet operation log analysis data collected from the Internet data source in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application to obtain an Internet operation log analysis input matrix.

[0016] Figure 5 The present invention is a flowchart of performing feature encoding on the Internet operation log analysis input matrix to obtain the Internet operation log analysis feature vector in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application.

[0017] Figure 6 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0019] Exemplary Systems

[0020] Figure 1 This is a flow chart of the Internet security risk analysis method based on big data analysis technology in an embodiment of the present application. Figure 1 As shown, according to the Internet security risk analysis method based on big data analysis technology according to the embodiment of the present application, it includes: S110, obtaining security risk sample data collected by big data and Internet operation log analysis data collected from an Internet data source; S120, extracting security risk sample information semantic feature vectors and Internet operation log analysis feature vectors from the security risk sample data collected by big data and the Internet operation log analysis data collected from the Internet data source; S130, obtaining a security risk prediction classification level based on the security risk sample information semantic feature vectors and the Internet operation log analysis feature vectors.

[0021] In the above-mentioned Internet security risk analysis method based on big data analysis technology, the step S110 obtains security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources, wherein the security risk sample data collected by big data includes malware samples, security event records, and vulnerability information, and the Internet operation log analysis data collected from Internet data sources includes execution log data, traffic data, service data, SNMP data, and Net-Flow data. It should be understood that in the network environment, there are various threats and vulnerabilities, including network attacks, malware, data leakage, identity theft and other problems. These security risks may lead to serious consequences such as personal privacy leakage, property loss, and information leakage, which will have a serious impact on individuals, organizations and even the entire society. Traditional Internet security analysis methods are usually based on static rules or manual analysis, which often cannot discover new threats and attacks in time. Therefore, as network threats become increasingly complex and diverse, more intelligent and advanced methods are needed to cope with security challenges to protect the security and privacy of Internet users. In the technical solution of the present application, by obtaining security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources, deep learning technology is combined for processing. Through this method, the classification level of security risks can be predicted, and real-time prediction and response to security risks can be achieved. This helps to identify and deal with potential threats in a timely manner and helps adapt to the ever-changing network security environment.

[0022] Specifically, the security risk sample data collected by big data includes malware samples, security event records and vulnerability information. These data provide information about known security threats and vulnerabilities, which helps to identify and classify potential security risks. Malware samples can help analyze the behavioral characteristics and propagation methods of malicious code, security event records record security events that occur in the system, and vulnerability information reveals potential security vulnerabilities in the system. On the other hand, the Internet operation log analysis data collected from the Internet data source includes multiple types of data such as execution log data, traffic data, service data, SNMP data and Net-Flow data. Execution log data records the execution of various operations in the system, traffic data reflects the network communication situation, service data contains the operation status of various services in the system, SNMP data provides monitoring information of network devices, and Net-Flow data can be used for traffic analysis and network behavior monitoring. These data sources provide information about network operation status, communication traffic, service operation status, etc., which helps to discover abnormal behavior, network attacks and security vulnerabilities. By comprehensively utilizing the security risk sample data collected by big data and the Internet operation log analysis data collected from the Internet data source, a comprehensive security risk analysis model can be constructed. By extracting features, analyzing and modeling these data, a comprehensive assessment and prediction of network security risks can be achieved. This method based on big data analysis technology can improve the accuracy and efficiency of security incident detection, strengthen the monitoring and response capabilities of network security threats, and thus ensure the safe and stable operation of network systems.

[0023] In the above-mentioned Internet security risk analysis method based on big data analysis technology, the step S120 extracts the security risk sample information semantic feature vector and the Internet operation log analysis feature vector from the security risk sample data collected by big data and the Internet operation log analysis data collected from the Internet data source. It should be understood that in the security risk sample data, extracting the security risk sample information semantic feature vector can help reveal the key features of malware samples, security event records and vulnerability information, such as behavioral characteristics, propagation paths, vulnerability types, etc. These feature vectors can be used to establish security risk models and classifiers, so as to predict and classify unknown security risks. In the Internet operation log analysis data, extracting the Internet operation log analysis feature vector can reflect key information such as network operation status, communication traffic, and service usage. By extracting features from execution log data, traffic data, service data, SNMP data, and Net-Flow data, abnormal behaviors, signs of network attacks, and potential security vulnerabilities can be discovered, providing important references for network security monitoring and response. In this way, the information value in the data can be used to establish an effective security risk analysis model, improve network security protection capabilities, and respond to various security threats and attacks in a timely manner.

[0024] In a specific embodiment of the present application, the step S120 includes: performing feature extraction on the security risk sample data collected by big data to obtain the security risk sample information semantic feature vector; performing feature extraction on the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis feature vector.

[0025] It should be understood that the security risk sample data includes malware samples, security incident records and vulnerability information. These data contain information about various security threats and vulnerabilities. Feature extraction can transform this information into a form that can be processed by machine learning and data analysis algorithms, and extract the behavior characteristics of malware, key attributes of security incidents, and type information of vulnerabilities. These features can be structured data, such as file size and file type, or unstructured data, such as behavior sequence and communication mode. By performing feature extraction on security risk sample data, the original data can be transformed into a high-dimensional feature vector representation. These feature vectors can contain rich information, such as frequently occurring behavior patterns, abnormal data points, specific vulnerability features, etc.

[0026] Furthermore, Internet operation log data includes log information generated by network devices, servers, applications, etc. during operation. These data record key information such as network communication, service usage, and abnormal events. It should be understood that the purpose of feature extraction is to extract representative and key information features from huge log data to support network performance analysis, security monitoring, and anomaly detection. By performing feature extraction on Internet operation log analysis data, the original data can be converted into a high-dimensional feature vector representation, which can reflect the characteristics and laws of network operation.

[0027] Figure 2 This is a flowchart of extracting features of the security risk sample data collected by big data to obtain the semantic feature vector of the security risk sample information in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application. Figure 2 As shown, in a specific embodiment of the present application, feature extraction is performed on the security risk sample data collected by big data to obtain the semantic feature vector of the security risk sample information, including: S210, security risk sample information word embedding encoding is performed on the security risk sample data collected by big data to obtain a security risk sample information word embedding vector sequence; S220, the security risk sample information word embedding vector sequence is passed through a security risk sample information context semantic encoder based on a Taming model to obtain the security risk sample information semantic feature vector.

[0028] It should be understood that the security risk sample data contains various security threats and vulnerability information. Word embedding encoding can convert this information into vector form, thereby achieving semantic understanding and analysis of security risk information. Among them, word embedding is a technology that maps words in a text to a continuous vector space. Word embedding encoding can represent each word as a dense vector, so that words with similar semantics are close in the vector space. Word embedding encoding of security risk sample information can convert security-related words, phrases, and sentences into semantically rich vector representations, thereby extracting the semantic features of security information.

[0029] Furthermore, the Taming model is a model based on a deep neural network, which can convert text data into a high-dimensional semantic feature representation by learning the semantic information of large-scale text data. After the security risk sample information is processed by the context semantic encoder of the Taming model, a richer and more abstract semantic feature vector can be obtained. These feature vectors contain the deep semantic information of the security risk sample information and can better reflect the meaning and context of the text data. By using the context semantic encoder of the security risk sample information based on the Taming model, the semantic understanding and characterization of the security risk sample information can be achieved. This encoder can convert the security risk sample information into a continuous semantic feature vector, so that the computer can better understand the meaning and contextual relationship of the text data, thereby improving the accuracy and efficiency of security risk identification and classification. Specifically, the Bert model based on the converter of the context semantic encoder of the security risk sample information based on the Taming model is used to perform global context semantic encoding on the word embedding vector sequence of the security risk sample information to obtain multiple feature vectors; and the multiple feature vectors are cascaded to obtain the semantic feature vector of the security risk sample information.

[0030] Figure 3 The present invention is a flowchart of extracting features from the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis feature vector in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application. Figure 3 As shown, in a specific embodiment of the present application, feature extraction is performed on the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis feature vector, including: S310, data preprocessing is performed on the Internet operation log analysis data collected from the Internet data source to obtain an Internet operation log analysis input matrix; S320, feature encoding is performed on the Internet operation log analysis input matrix to obtain the Internet operation log analysis feature vector.

[0031] It should be understood that data preprocessing includes steps such as data cleaning, data integration, data transformation, and data reduction. In the cleaning stage, duplicate data is removed, missing values ​​and outliers are processed, and data quality is ensured. The data integration stage involves integrating data from different sources into a unified data set for analysis. The data transformation stage includes standardizing, normalizing or converting the data to suit the needs of the model. The data reduction stage aims to reduce the complexity of the data set and improve computational efficiency. For Internet operation log analysis data, the goal of data preprocessing is to convert the original log data into an input matrix suitable for processing by machine learning or deep learning models. This input matrix is ​​usually a two-dimensional array, where each row represents a log sample and each column represents a feature or attribute. By converting the log data into a matrix form, various data analysis and machine learning algorithms can be easily applied for further processing and analysis. By preprocessing the log data, key feature information such as IP address, request type, response time, etc. can be extracted to form a structured input matrix.

[0032] Furthermore, feature encoding is the process of converting each feature in the original data into a form that can be processed by a computer. In the analysis of Internet operation logs, feature encoding can include operations such as word embedding for text data, one-hot encoding for categorical data, and standardization or normalization of numerical data. Through feature encoding, different types of data can be uniformly represented as feature vectors to better reflect the characteristics and attributes of the data.

[0033] Figure 4 The present invention is a flowchart of performing data preprocessing on the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis input matrix in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application. Figure 4 As shown, in a specific embodiment of the present application, data preprocessing is performed on the Internet operation log analysis data collected from the Internet data source to obtain an Internet operation log analysis input matrix, including: S410, word segmentation is performed on the Internet operation log analysis data collected from the Internet data source to obtain multiple Internet operation log analysis data items; S420, Internet operation log analysis information embedding encoding is performed on the multiple Internet operation log analysis data items to obtain Internet operation log analysis embedding vectors; S430, the Internet operation log analysis embedding vectors are arranged in two dimensions to obtain the Internet operation log analysis input matrix.

[0034] It should be understood that word segmentation is the process of dividing continuous text data into words or phrases with independent meanings. In the analysis of Internet operation logs, log data usually contains a large amount of text information, including request information, response information, user behavior, etc. By performing word segmentation on these text data, complex text information can be split into multiple meaningful data items, such as words, phrases or named entities, making the data easier to understand and analyze. Through word segmentation, key information in text data can be better captured and important words and phrases can be identified. In addition, word segmentation can also help reduce the complexity of data and improve the efficiency and accuracy of text processing. In practical applications, the multiple data items obtained through word segmentation can be used to build a bag of words model, TF-IDF model or Word2Vec model, etc., to further mine the semantic information and relevance of text data.

[0035] Furthermore, Internet operation log analysis information embedding coding is a technique that maps text data to a low-dimensional continuous vector space, in which words or phrases with similar meanings will be closer in the vector space, thereby better capturing the semantic relationship between words. The process of generating Internet operation log analysis embedding vectors usually involves using word embedding models (such as Word2Vec, GloVe, FastText, etc.) or deep learning models (such as BERT, GPT, etc.) to learn the representation of text data. These models can convert text data into dense vector representations, making text information easier for computers to process and understand.

[0036] Furthermore, in deep learning, neural networks usually accept fixed-size inputs, while text data is of variable length. The process of arranging the embedding vectors of Internet operation log analysis in two dimensions to form an input matrix can convert text data of variable length into a fixed-size matrix to meet the input requirements of the neural network. By arranging the embedding vectors into a two-dimensional matrix according to certain rules, the structural and semantic information of the text data can be maintained, while providing a more standardized input for the deep learning model. This processing method helps to improve the model's ability to understand text data, allowing the model to better capture the features and patterns in text data.

[0037] Figure 5 This is a flow chart of performing feature encoding on the Internet operation log analysis input matrix to obtain the Internet operation log analysis feature vector in the Internet security risk analysis method based on big data analysis technology according to an embodiment of the present application. Figure 5As shown, in a specific embodiment of the present application, feature encoding is performed on the Internet operation log analysis input matrix to obtain the Internet operation log analysis feature vector, including: S510, passing the Internet operation log analysis input matrix through an Internet operation log analysis convolutional neural network as a feature encoder to obtain an Internet operation log analysis feature graph; S520, pooling the Internet operation log analysis feature graph to obtain the Internet operation log analysis feature vector.

[0038] It should be understood that by using the Internet operation log analysis input matrix as the input of the convolutional neural network, the network can use structures such as convolutional layers and pooling layers to extract and abstract features of text data, thereby generating an Internet operation log analysis feature map. The convolution operation can effectively capture local patterns and features in text data, while the pooling operation helps to reduce the dimension of the feature map and retain the most important information. The process of generating the Internet operation log analysis feature map gradually transforms the original text data into a more abstract and advanced feature representation through the multi-layer convolution and pooling operations of the convolutional neural network. Specifically, using each layer of the Internet operation log analysis convolutional neural network as a feature encoder, in the forward transfer of the layer, the following operations are performed on the input data: using the convolution units of each layer of the Internet operation log analysis convolutional neural network as a feature encoder to perform convolution processing on the input data to obtain a convolution feature map; using the pooling units of each layer of the Internet operation log analysis convolutional neural network as a feature encoder to perform pooling processing on the convolution feature map along the channel dimension to obtain a pooling feature map; and using the activation units of each layer of the Internet operation log analysis convolutional neural network as a feature encoder to perform nonlinear activation on the feature values ​​of each position in the pooling feature map to obtain an activation feature map; wherein the output of the last layer of the Internet operation log analysis convolutional neural network as a feature encoder is the Internet operation log analysis feature map.

[0039] Furthermore, the pooling operation can reduce the dimension of the data and the amount of computation by aggregating the features in the feature map, while retaining the most significant feature information. Commonly used pooling operations include maximum pooling and average pooling, which can extract the most significant features in the feature map and summarize the feature values ​​of each region in the feature map to generate a more compact feature representation. The feature vector obtained by the pooling operation can better represent the feature information of the original feature map and has higher abstraction and generalization capabilities.

[0040] In the above-mentioned Internet security risk analysis method based on big data analysis technology, the step S130 obtains the security risk prediction classification level based on the security risk sample information semantic feature vector and the Internet operation log analysis feature vector. It should be understood that for the security risk prediction classification level, a comprehensive analysis can be performed based on the security risk sample information semantic feature vector and the Internet operation log analysis feature vector to obtain a more accurate prediction result. Among them, the security risk sample information semantic feature vector contains semantic information about the security risk sample, and the Internet operation log analysis feature vector contains feature representations about the network operation status. By fusing these two feature vectors, the semantic information of the security risk sample and the characteristics of the network operation status can be comprehensively considered, thereby improving the accuracy and reliability of security risk prediction.

[0041] In a specific embodiment of the present application, the step S130 includes: fusing the semantic feature vector of the security risk sample information and the Internet operation log analysis feature vector to obtain a security risk level prediction classification feature matrix; performing sensitivity scattering based on location information on the security risk level prediction classification feature matrix to obtain an optimized security risk level prediction classification feature matrix; and passing the optimized security risk level prediction classification feature matrix through a classifier to obtain a security risk prediction classification level.

[0042] It should be understood that the process of fusing the semantic feature vector of security risk sample information and the feature vector of Internet operation log analysis is to comprehensively utilize different types of information to improve the accuracy and reliability of security risk prediction. The semantic feature vector of security risk sample information contains semantic information about the security risk sample, which can reveal the potential threats and risk characteristics of the sample. These semantic feature vectors reflect the content, behavior pattern and potential danger of the sample, which helps to identify potential security threats. The feature vector of Internet operation log analysis contains feature representations about the network operation status, which can reflect the network's activities, traffic conditions and abnormal behaviors. These feature vectors provide important information about the network operation status and help to discover abnormal conditions and security vulnerabilities in the network. By fusing these two feature vectors, the semantic information of the security risk sample and the characteristics of the network operation status can be comprehensively considered, so as to more comprehensively analyze the security risk and predict the security level. The fused feature matrix can better capture the multi-faceted characteristics of security risks and improve the accuracy and reliability of prediction.

[0043] Further, the security risk level prediction classification feature matrix is ​​subjected to sensitivity scattering based on position information to obtain an optimized security risk level prediction classification feature matrix, including: calculating a natural exponential function value raised to the power of the eigenvalue of the predetermined position of the security risk level prediction classification feature matrix and subtracting one to obtain a characteristic index difference; calculating a ratio of the characteristic index difference to the eigenvalue of the predetermined position of the security risk level prediction classification feature matrix and then taking an absolute value to obtain a first absolute value; activating the first absolute value through a softmax function to obtain an activation value, and multiplying the activation value by the eigenvalue of the predetermined position of the security risk level prediction classification feature matrix to obtain a feature activation value; Calculate a natural exponential function value raised to the power of the opposite number of the eigenvalue at the predetermined position of the security risk level prediction classification feature matrix to obtain a first natural exponential function value; calculate the quotient of the eigenvalue at the predetermined position of the security risk level prediction classification feature matrix divided by the first natural exponential function value and then take the absolute value to obtain a second absolute value; calculate the logarithmic function value with base 2 of the second absolute value, and multiply the logarithmic function value by the eigenvalue at the predetermined position of the security risk level prediction classification feature matrix to obtain a feature logarithmic activation value; calculate a weighted sum of the feature activation value and the feature logarithmic activation value to obtain the eigenvalue at the predetermined position of the optimized security risk level prediction classification feature matrix.

[0044] In particular, in the technical solution of the present application, it is considered that in this technical solution, there may be too many malware samples, security incident records or vulnerability information of certain specific types in the security risk sample data, resulting in certain features being highly concentrated at specific positions in the feature matrix. The feature extraction algorithm used in the word embedding encoding of the security risk sample information and the Internet operation log analysis data processing may cause certain features to aggregate at specific positions. Some algorithms may amplify the influence of certain features, making them appear abnormally concentrated in the feature matrix. When the semantic feature vector of the security risk sample information and the feature vector of the Internet operation log analysis are fused, some features may affect each other at specific positions, resulting in uneven distribution of these features in the security risk level prediction classification feature matrix. That is, the feature distribution in the security risk level prediction classification feature matrix may have local significant aggregation anomalies, that is, some features are highly concentrated at specific positions. This will produce local deviations, causing the classifier to be overly sensitive to the features at these positions and insufficiently sensitive to the features at other positions. On the other hand, when classification is performed by a classifier, the position information in the security risk level prediction classification feature matrix is ​​usually lost. This will cause the classifier to be unable to consider the position information of the feature, thereby causing the inductive bias of the classification. In order to solve the above problem, in the technical solution of the present application, sensitivity scattering based on location information is performed on the security risk level prediction classification feature matrix.

[0045] Specifically, the security risk level prediction classification feature matrix is ​​subjected to sensitivity scattering based on location information using the following optimization formula to obtain an optimized security risk level prediction classification feature matrix, wherein the optimization formula is:

[0046]

[0047] in, is the first The eigenvalues ​​of the positions, and represents the weighting coefficient, represents the normalized exponential function, represents the logarithmic function value with base 2, is the first The eigenvalue of the location.

[0048] Based on this, in the technical solution of the present application, the security risk level prediction classification feature matrix is ​​subjected to sensitivity scattering based on position information, and the above-mentioned problem is solved by scattering the features in the security risk level prediction classification feature matrix to multiple positions related to its label position. Specifically, the sensitivity scattering based on position information of the security risk level prediction classification feature matrix retains the position information, ensuring that the scattered feature matrix still maintains the original position information, and at the same time, the scattered feature distribution is aligned with the label position, thereby enhancing the classifier's ability to capture the sensitivity of the label position. Furthermore, through the scattered features, the classifier can consider the position information of the features more comprehensively, thereby reducing the inductive bias of the classification.

[0049] Furthermore, the optimized security risk level prediction classification feature matrix is ​​processed by a classifier to obtain a security risk prediction classification level in order to convert the fused feature information into a specific risk level assessment, helping system administrators and security experts to better identify and respond to potential security threats. When processing security risk predictions, the classifier can analyze and map the input feature vectors, such as a feature matrix that combines the semantic features of security risk sample information and the analysis features of Internet operation logs, to the corresponding security risk level. By inputting the feature matrix into the classifier, it is possible to quickly and accurately predict security risks, helping to promptly discover potential security threats and take corresponding preventive measures.

[0050] In summary, the embodiment of the present application first obtains security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally uses a classifier to obtain a security risk prediction classification level, thereby achieving real-time security risk prediction and response, which helps to timely discover and respond to potential threats, and then adapt to the ever-changing network security environment.

[0051] Exemplary Electronic Devices

[0052] Below, reference Figure 6 To describe an electronic device according to an embodiment of the present application.

[0053] Figure 6 A structural diagram of an electronic device provided in an embodiment of the present application, the electronic device 10 includes: a processor 11, a memory 12, a bus 13 and a communication interface 14, the processor 11, the communication interface 14 and the memory 12 are connected via the bus 13; the processor 11 is used to execute an executable module stored in the memory 12, such as a computer program.

[0054] The memory 12 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 14 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0055] The bus 13 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0056] Among them, the memory 12 is used to store programs, and the processor 11 executes the program after receiving the execution instruction. The method executed by the device for flow process definition disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 11, or implemented by the processor 11.

[0057] The processor 11 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 11. The above processor 11 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 12, and the processor 11 reads the information in the memory 12 and completes the steps of the above method in combination with its hardware.

[0058] Corresponding to the above method, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above method.

[0059] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0060] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0061] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0062] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, electronic device, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0063] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for analyzing Internet security risks based on big data analysis technology, characterized in that: include: Obtain security risk sample data collected by big data and Internet operation log analysis data collected from Internet data sources; Extracting a security risk sample information semantic feature vector and an Internet operation log analysis feature vector from the security risk sample data collected by the big data and the Internet operation log analysis data collected from the Internet data source; Based on the security risk sample information semantic feature vector and the Internet operation log analysis feature vector, a security risk prediction classification level is obtained; Wherein, based on the semantic feature vector of the security risk sample information and the Internet operation log analysis feature vector, a security risk prediction classification level is obtained, including: The security risk sample information semantic feature vector and the Internet operation log analysis feature vector are merged to obtain a security risk level prediction classification feature matrix; Performing sensitivity scattering based on location information on the security risk level prediction classification feature matrix to obtain an optimized security risk level prediction classification feature matrix; Passing the optimized security risk level prediction classification feature matrix through a classifier to obtain a security risk prediction classification level; The security risk level prediction classification feature matrix is ​​subjected to sensitivity scattering based on location information to obtain an optimized security risk level prediction classification feature matrix, including: Calculate a natural exponential function value raised to a power of the eigenvalue of a predetermined position of the security risk level prediction classification feature matrix and subtract one to obtain a feature exponent difference; Calculating the ratio of the characteristic index difference to the characteristic value of the predetermined position of the safety risk level prediction classification characteristic matrix and then taking the absolute value to obtain a first absolute value; Activating the first absolute value through a softmax function to obtain an activation value, and multiplying the activation value by the feature value of a predetermined position of the security risk level prediction classification feature matrix to obtain a feature activation value; Calculating a natural exponential function value raised to a power of the opposite number of the eigenvalue at a predetermined position of the security risk level prediction classification feature matrix to obtain a first natural exponential function value; Calculate the quotient of the eigenvalue of the predetermined position of the security risk level prediction classification feature matrix divided by the first natural exponential function value and then take the absolute value to obtain a second absolute value; Calculating a logarithmic function value with base 2 of the second absolute value, and multiplying the logarithmic function value by a eigenvalue at a predetermined position of the security risk level prediction classification feature matrix to obtain a feature logarithmic activation value; A weighted sum of the feature activation value and the feature logarithmic activation value is calculated to obtain a feature value at a predetermined position of the optimized security risk level prediction classification feature matrix.

2. The Internet security risk analysis method based on big data analysis technology according to claim 1 is characterized in that: Extracting a security risk sample information semantic feature vector and an Internet operation log analysis feature vector from the security risk sample data collected by the big data and the Internet operation log analysis data collected from the Internet data source, including: Performing feature extraction on the security risk sample data collected from the big data to obtain a semantic feature vector of the security risk sample information; Feature extraction is performed on the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis feature vector.

3. The Internet security risk analysis method based on big data analysis technology according to claim 2 is characterized in that: Extracting features from the security risk sample data collected from the big data to obtain a semantic feature vector of the security risk sample information includes: Performing security risk sample information word embedding encoding on the security risk sample data collected from the big data to obtain a security risk sample information word embedding vector sequence; The security risk sample information word embedding vector sequence is passed through a security risk sample information context semantic encoder based on a Taming model to obtain the security risk sample information semantic feature vector.

4. The Internet security risk analysis method based on big data analysis technology according to claim 3 is characterized in that: Performing feature extraction on the Internet operation log analysis data collected from the Internet data source to obtain the Internet operation log analysis feature vector includes: Performing data preprocessing on the Internet operation log analysis data collected from the Internet data source to obtain an Internet operation log analysis input matrix; Feature encoding is performed on the Internet operation log analysis input matrix to obtain the Internet operation log analysis feature vector.

5. The Internet security risk analysis method based on big data analysis technology according to claim 4 is characterized in that: The Internet operation log analysis data collected from the Internet data source is preprocessed to obtain an Internet operation log analysis input matrix, including: Segmenting the Internet operation log analysis data collected from the Internet data source to obtain a plurality of Internet operation log analysis data items; Performing Internet operation log analysis information embedding encoding on the plurality of Internet operation log analysis data items to obtain Internet operation log analysis embedding vectors; The Internet operation log analysis embedding vectors are arranged in two dimensions to obtain the Internet operation log analysis input matrix.

6. The Internet security risk analysis method based on big data analysis technology according to claim 5 is characterized in that: Performing feature encoding on the Internet operation log analysis input matrix to obtain the Internet operation log analysis feature vector includes: Passing the Internet operation log analysis input matrix through an Internet operation log analysis convolutional neural network as a feature encoder to obtain an Internet operation log analysis feature graph; The Internet operation log analysis feature graph is pooled to obtain the Internet operation log analysis feature vector.

Images