A method and system for information security protection based on big data

Abstract

The present invention discloses an information security protection method and system based on big data, the method comprising: obtaining an access request for a target file, the access request carrying an initiation address of an access initiator and a target business to be executed by the access initiator; determining an associated file related to the target file according to the target business, the associated file being a file that needs to be accessed together with the target file when the target business is executed; obtaining an access address of the associated file, and detecting access flow information of the access initiator to the associated file according to the initiation address and the access address; and executing the access request to the target file if the access flow information meets preset requirements. The present invention can effectively protect big data information.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to an information security protection method and system based on big data. Background Art

[0002] Big data information security protection is the process of ensuring that the information stored and processed in the big data system is protected and processed securely. Due to the huge amount of data involved in the big data system, the complex sources, and the sensitive information that may be involved in the data processing process, information protection becomes particularly important.

[0003] Currently, the information security protection of big data usually sets access rights for users to prevent some sensitive information from being illegally accessed. However, this method requires labeling a large amount of user information, which requires a lot of manpower costs, has low protection efficiency, and in the event of user information leakage, the accessed information cannot be well protected. Summary of the invention

[0004] In view of the technical problems in the prior art of inadequate information protection and low protection efficiency for big data, the present invention provides an information security protection method and system based on big data.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0006] According to a first aspect of an embodiment of the present invention, there is provided a method for information security protection based on big data, the method comprising:

[0007] Obtaining an access request for a target file, the access request carrying an initiating address of an access initiator and a target service to be executed by the access initiator;

[0008] Determine, according to the target service, an associated file related to the target file, wherein the associated file is a file that needs to be accessed together with the target file when the target service is executed;

[0009] Acquire the access address of the associated file, and detect the access flow information of the access initiator to the associated file according to the initiation address and the access address;

[0010] If the access traffic information meets the preset requirement, the access request is executed on the target file.

[0011] Optionally, before executing the access request on the target file if the access traffic information meets a preset requirement, the method further includes:

[0012] Obtaining reference traffic information of the associated file corresponding to the target service;

[0013] Comparing the access flow information with the reference flow information;

[0014] If the access traffic information matches the reference traffic information, it is determined that the access traffic information meets the preset requirement.

[0015] Optionally, the reference traffic information includes reference traffic at multiple specified moments, and the access traffic information includes access traffic at multiple moments. Before determining that the access traffic information meets a preset requirement if the access traffic information matches the reference traffic information, the method further includes:

[0016] If the multiple moments include the multiple specified moments, filtering the access traffic at the multiple specified moments from the access traffic at the multiple moments;

[0017] For each of the multiple specified time periods, calculating a difference between a reference flow rate and an access flow rate corresponding to the specified time period to obtain multiple difference values;

[0018] Adding the absolute values ​​of the plurality of differences and dividing the sum by the number of the plurality of differences to obtain a distance evaluation value;

[0019] If the distance evaluation value is less than or equal to a preset evaluation value, it is determined that the access traffic information matches the reference traffic information.

[0020] Optionally, the method further comprises:

[0021] If the multiple moments do not include the multiple specified moments, generating an access flow curve according to the access flow at the multiple moments, and generating a reference flow curve according to the reference flow at the multiple specified moments;

[0022] Identifying an inflection point of the access traffic curve, and dividing the access traffic curve into a plurality of sub-traffic curves based on the inflection point, wherein each of the plurality of sub-traffic curves corresponds to a slope;

[0023] Obtain the target slope corresponding to each sub-flow curve and obtain a slope sequence;

[0024] If the slope sequence matches the reference traffic curve, it is determined that the access traffic information meets the preset requirement.

[0025] Optionally, before determining that the access traffic information meets a preset requirement if the slope sequence matches the reference traffic curve, the method further includes:

[0026] Obtaining a time period corresponding to each sub-flow curve to obtain a plurality of target time periods;

[0027] Acquire multiple reference slopes corresponding to the multiple target time periods in the reference flow curve;

[0028] For each target time period, comparing the reference slope corresponding to the target time period with the target slope to obtain a slope error corresponding to the target time period;

[0029] If the slope error corresponding to each of the target time periods does not exceed the error threshold, it is determined that the slope sequence matches the reference flow curve.

[0030] Optionally, before obtaining the slope corresponding to each sub-flow curve to obtain the slope sequence, the method further includes:

[0031] Obtaining the number of curves of the plurality of sub-flow curves;

[0032] If the number of curves of the plurality of sub-flow curves matches the reference flow curve, the step of acquiring the slope corresponding to each sub-flow curve to obtain a slope sequence is performed.

[0033] Optionally, after executing the access request on the target file if the access flow information meets a preset requirement, the method further includes:

[0034] Acquire the first access flow information collected on the associated file and the second access flow information collected on the target file during the execution of the target business in a historical time period;

[0035] Performing model training based on the first access traffic information and the second access traffic information to obtain a traffic prediction model;

[0036] When the current access flow information of the associated file is obtained, the access flow of the target file is predicted using the flow prediction model to obtain predicted access flow information;

[0037] Obtaining a target access address of a target file, and detecting current access flow information of the target file according to the initiating address and the target access address;

[0038] Comparing the current access flow information of the target file with the predicted access flow information to obtain a flow information error;

[0039] If the flow information error exceeds the information error threshold, the access permission of the access initiator to the target file is closed.

[0040] Optionally, the first access traffic information includes first access traffic at multiple moments, and the second access traffic information includes second access traffic at the multiple moments; and the performing model training based on the first access traffic information and the second access traffic information to obtain the traffic prediction model includes:

[0041] Generate a first traffic curve based on first access traffic at multiple moments, and generate a second traffic curve based on second access traffic at the multiple moments;

[0042] extracting a first curve feature from the first flow curve, and extracting a second curve feature from the second flow curve;

[0043] Model training is performed based on the first curve feature and the second curve feature to obtain the flow prediction model.

[0044] Optionally, there are multiple associated files, and the multiple associated files are respectively stored in different nodes of a preset distributed system.

[0045] According to a second aspect of an embodiment of the present invention, there is provided an information protection system based on big data, the system comprising:

[0046] A request acquisition module, used to acquire an access request for a target file, wherein the access request carries an initiating address of an access initiator and a target service to be executed by the access initiator;

[0047] A determination module, configured to determine, according to the target service, an associated file related to the target file, wherein the associated file is a file that needs to be accessed together with the target file when the target service is executed;

[0048] A flow detection module, used to obtain the access address of the associated file, and detect the access flow information of the access initiator to the associated file according to the initiation address and the access address;

[0049] An execution module is used to execute the access request on the target file if the access flow information meets a preset requirement.

[0050] The present invention provides an information security protection method and system based on big data. Compared with the prior art, it has the following beneficial effects:

[0051] The solution provided by this embodiment obtains an access request for a target file, the access request carries the initiation address of the access initiator and the target business to be executed by the access initiator; then determines the associated file related to the target file according to the target business, wherein the associated file is a file that needs to be accessed together with the target file when the target business is executed; then, obtains the access address of the associated file, and detects the access flow information of the access initiator to the associated file according to the initiation address and the access address; if the access flow information meets the preset requirements, the access request is executed on the target file. Since users usually access different files when executing a business, the files required under the same business will have a certain correlation, so this embodiment determines whether the access to the target file is abnormal by detecting the access flow information of the associated file associated with the target file, thereby determining whether the target file can be accessed, which plays a good role in protecting the target file. Since the access flow information is not easy to be tampered with, the protection strength is further improved. In addition, the operation of setting permissions for user information is avoided, which greatly improves the protection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is a schematic diagram of an application scenario of an information security protection method based on big data according to an exemplary embodiment;

[0053] Figure 2 is a flow chart of an information security protection method based on big data according to an exemplary embodiment;

[0054] Figure 3 is a schematic diagram of a reference flow curve according to an exemplary embodiment;

[0055] Figure 4 is a schematic diagram of an access traffic curve according to an exemplary embodiment;

[0056] Figure 5 It is a principle block diagram of an information protection system based on big data according to an exemplary embodiment. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] It is understandable that in the specific implementation of this application, data related to access requests, addresses, etc. is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0059] Figure 1 is a schematic diagram of an application environment of an information security protection method based on big data according to an exemplary embodiment. Figure 1 As shown, the application environment may include a server 100 and a mobile terminal 200, the server 100 is in communication connection with the mobile terminal 200, the server 100 may store a plurality of files for users to access when performing business, wherein the access to the files may include modifying the content of the files, deleting the content, uploading the content, downloading the content, and the like. Optionally, the server 100 may be a separate server or a server cluster, which is not limited here. The mobile terminal 200 may be a device used by the user to send an access request to the server 100. Optionally, the mobile terminal 200 may include, but is not limited to: a tablet computer, a smart phone, a laptop computer, an image acquisition device, and the like. Optionally, the number of the server 100 and the mobile terminal 200 may be one or more, which is not limited here.

[0060] Figure 2 is a flowchart of an information security protection method based on big data according to an exemplary embodiment. Figure 2 As shown, the above method comprises the following steps:

[0061] 101. Obtain an access request for a target file, where the access request carries an initiating address of an access initiator and a target business to be executed by the access initiator.

[0062] Exemplarily, the information security protection method based on big data can be applied to the above-mentioned server.

[0063] The access request may be a request sent by the access initiator to the server for applying for access to the target file. In addition to the above information, the access request may also carry file information of the target file, such as the name, identifier, type, access address, etc. of the target file.

[0064] The initiating address may be a network address from which the access initiator sends the access request.

[0065] The access address of the target file may be a network address, that is, an address at which the target file can be accessed through a network protocol (such as HTTP, FTP, SFTP, etc.).

[0066] The target business is the business that the access initiator needs to execute currently, which may be a transaction business, a project progress update business, and the like.

[0067] It can be understood that the target file is a file that must be accessed when the target service is executed.

[0068] 102. Determine an associated file related to the target file according to the target business, where the associated file is a file that needs to be accessed together with the target file when the target business is executed.

[0069] For example, when the target service is executed, file 1, file 2, file 3 and file 4 need to be accessed. Among them, file 4 is the target file, and file 1, file 2 and file 3 are associated files. Optionally, the files that need to be accessed by each service in the multiple services when they are executed can be bound to the service in advance, and the binding relationship can be stored locally on the server, so that after the server determines the target file and the target service, it can quickly find the associated service according to the target service and the binding relationship.

[0070] There are multiple associated files, and the multiple associated files are respectively stored in different nodes of the preset distributed system.

[0071] For example, the preset distributed system may include multiple electronic devices that communicate with each other, each electronic device as a node, and multiple associated texts may be stored in multiple electronic devices respectively, thereby increasing the difficulty for illegal users to extract information from the associated texts, greatly increasing the protection of information. Optionally, each electronic device may store one or more associated texts.

[0072] 103. Obtain an access address of the associated file, and detect access flow information of the access initiator to the associated file based on the initiation address and the access address.

[0073] For example, if the initiating address is IP address 1 and the access address is IP address 2, the server can detect the traffic information when IP address 1 and IP address 2 transmit data in real time, and use the traffic information as access traffic information.

[0074] Among them, the IP address is the unique identifier of a computer on the network, which is used to locate and find computer devices.

[0075] The flow information may include the number of data packets transmitted or the data transmission volume at each moment during the data transmission process.

[0076] 104. If the access flow information meets the preset requirements, the access request is executed on the target file.

[0077] In some embodiments, the method may further include:

[0078] If the access traffic information meets the preset requirements, no processing is performed on the access request, and a prompt message indicating that the target file is illegally accessed is output. The prompt message may be audio information, text information, image information, etc.

[0079] Before step 104, the method may further include:

[0080] S1. Obtain reference traffic information of a target service corresponding to an associated file.

[0081] The reference flow information of the target service corresponding to the associated file may be historical flow information collected in the process of accessing the associated file when the target service was normally executed in the past. The reference flow information of the target service corresponding to the associated file may be pre-stored locally on the server, and when needed, the corresponding reference flow information may be extracted from the server locally according to the identifier of the associated file and the identifier of the target service.

[0082] S2. Compare the access flow information with the reference flow information.

[0083] S3. If the access flow information matches the reference flow information, it is determined that the access flow information meets the preset requirements.

[0084] In some implementations, the reference traffic information includes reference traffic at multiple specified times, and the access traffic information includes access traffic at multiple times. Before step S3, the method may further include:

[0085] If the multiple time periods include multiple specified time periods, the access flows at the multiple specified time periods are filtered out from the access flows at the multiple time periods.

[0086] For example, multiple time points are t1, t2, t3, t4, t5, and t6. The reference flow corresponding to t1 is x1, the reference flow corresponding to t2 is x2, the reference flow corresponding to t3 is x3, the reference flow corresponding to t4 is x4, the reference flow corresponding to t5 is x5, and the reference flow corresponding to t6 is x6. Multiple specified time points are t1, t3, and t5. The access flow corresponding to t1 is y1, the access flow corresponding to t3 is y3, and the access flow corresponding to t5 is y5.

[0087] For each of the multiple specified time periods, a difference between the reference flow and the access flow corresponding to the specified time period is calculated to obtain multiple difference values.

[0088] Continuing with the above example, we can obtain the difference (x1-y1) corresponding to t1, the difference (x3-y3) corresponding to t3, and the difference (x5-y5) corresponding to t5.

[0089] The absolute values ​​of the multiple differences are added and divided by the number of the multiple differences to obtain a distance evaluation value.

[0090] Continuing with the above example, the distance evaluation value d0 can be expressed as d0 = (|x1-y1|+|x3-y3|+|x5-y5|) / 3.

[0091] If the distance evaluation value is less than or equal to the preset evaluation value, it is determined that the access traffic information matches the reference traffic information.

[0092] Continuing with the above example, for example, the preset evaluation value is d, if the distance evaluation value d0 is less than or equal to d, it can be determined that the access traffic information matches the reference traffic information.

[0093] It can be understood that the smaller the distance evaluation value is, the closer the access traffic information is to the reference traffic information. When the distance evaluation value is small to a certain extent (such as less than or equal to the preset evaluation value), it indicates that the gap between the access traffic information and the reference traffic information is negligible. At this time, it can be indicated that the access traffic information matches the reference traffic information.

[0094] It can be seen that in this embodiment, by calculating the difference between the reference flow and the access flow corresponding to each of the multiple specified moments, multiple differences are obtained, and the absolute values ​​of the multiple differences are added and divided by the number of the multiple differences to obtain a distance evaluation value. If the distance evaluation value is less than or equal to the preset evaluation value, it is determined that the access flow information matches the reference flow information. Therefore, it can be quickly and accurately determined whether the access flow information matches the reference flow information.

[0095] In some other embodiments, the method may further include:

[0096] If the multiple time periods do not include the multiple designated time periods, an access flow curve is generated according to the access flow at the multiple time periods, and a reference flow curve is generated according to the reference flow at the multiple designated time periods.

[0097] For example, Figure 3 As shown, when obtaining the reference flow rates at multiple specified times, the multiple specified times can be used as the horizontal coordinates and the reference flow rates as the vertical coordinates to obtain the coordinates corresponding to the multiple reference flow rates in a plane coordinate system, such as coordinate (t1, x1), coordinate (t2, x2), coordinate (t3, x3) coordinate (t4, x4) coordinate (t5, x5). Then, the above coordinates are connected to obtain the following: Figure 3 Reference flow curve shown.

[0098] like Figure 4As shown, when the access traffic at multiple times is obtained, the multiple times can be used as the horizontal coordinates and the access traffic as the vertical coordinates to obtain the coordinates corresponding to the multiple access traffic in a plane coordinate system, such as coordinate (t1, y1), coordinate (t1.3, y1.3), coordinate (t2, x2), coordinate (t2.6, y2.6) coordinate (t3.8, y3.8), and then the above coordinates are connected to obtain the following Figure 4 The access traffic curve is shown.

[0099] An inflection point of the access traffic curve is identified, and the access traffic curve is divided into a plurality of sub-traffic curves based on the inflection point, wherein each of the plurality of sub-traffic curves corresponds to a slope.

[0100] The inflection point may refer to a point where the slope of the access traffic curve changes.

[0101] For example, Figure 4 For example, the inflection point may include coordinates (t1.3, y1.3) and coordinates (t2.6, y2.6). Therefore, the curve between coordinates (0, 0) and coordinates (t1.3, y1.3) can be used as a sub-flow curve, the curve between coordinates (t1.3, y1.3) and coordinates (t2.6, y2.6) can be used as a sub-flow curve, and the curve between coordinates (t2.6, y2.6) and coordinates (t3.8, y3.8) can be used as a sub-flow curve.

[0102] The target slope corresponding to each sub-flow curve is obtained to obtain a slope sequence.

[0103] Continuing with the above example, for example, for the sub-flow curve between coordinates (t1.3, y1.3) and coordinates (t2.6, y2.6), the target slope corresponding to the sub-flow curve can be calculated as (y2.6-y1.3) / (t2.6-t1.3). Similarly, the target slope corresponding to each sub-flow curve can be calculated in the above manner, and multiple target slopes can be sorted in order from front to back in time to obtain a slope sequence.

[0104] If the slope sequence matches the reference flow curve, it is determined that the access flow information meets the preset requirements.

[0105] Optionally, before determining that the access traffic information meets a preset requirement if the slope sequence matches the reference traffic curve, the method further includes:

[0106] The time period corresponding to each sub-flow curve is obtained to obtain multiple target time periods.

[0107] Continuing with the above example, for example, the multiple target time periods include a first time period (0-t1.3), a second time period (t1.3-t2.6), and a third time period (t2.6-t3.8).

[0108] A plurality of reference slopes corresponding to a plurality of target time periods are obtained in the reference flow curve.

[0109] For each target time period, the reference slope corresponding to the target time period is compared with the target slope to obtain the slope error corresponding to the target time period.

[0110] Continuing with the above example, for example, a first slope k1 can be obtained from the access traffic curve according to the first time period, a second slope k2 can be obtained according to the second time period, and a third slope k3 can be obtained according to the third time period. Then, a fourth slope k4 can be obtained from the reference traffic curve according to the first time period, a fifth slope k5 can be obtained according to the fifth time period, and a sixth slope k6 can be obtained according to the sixth time period.

[0111] Then, for the first time period, the slope error can be obtained as |k1-k4|, for the second time period, the slope error can be obtained as |k2-k5|, and for the third time period, the slope error can be obtained as |k3-k6|.

[0112] If the slope error corresponding to each target time period does not exceed the error threshold, it is determined that the slope sequence matches the reference flow curve.

[0113] Continuing with the above example, for example, if |k1-k4|, |k2-k5|, and |k3-k6| are all smaller than the error threshold k, it can be determined that the slope sequence matches the reference flow curve.

[0114] Optionally, before obtaining the slope corresponding to each sub-flow curve to obtain the slope sequence, the method further includes:

[0115] Get the number of curves for multiple sub-flow curves.

[0116] If the number of curves of the plurality of sub-flow curves matches the reference flow curve, a step of obtaining a slope corresponding to each sub-flow curve to obtain a slope sequence is performed.

[0117] Exemplarily, the reference flow curve can be divided into reference sub-flow curves according to the inflection points in the reference flow curve, so that each reference sub-flow curve corresponds to a slope. Then, the number of reference sub-flow curves is obtained, and the number of reference sub-flow curves is compared with the number of curves of multiple sub-flow curves. If the numbers of the two are consistent, the step of obtaining the slope corresponding to each sub-flow curve and obtaining the slope sequence is performed. If the numbers of the two are inconsistent, the access request is not executed. Thereby improving the processing efficiency of the access request.

[0118] In this embodiment, when multiple moments do not include multiple specified moments, an access traffic curve is generated according to the access traffic at multiple moments, and a reference traffic curve is generated according to the reference traffic at multiple specified moments, and whether the access to the target file is abnormal is determined based on the matching between the access traffic curve and the reference traffic curve, thereby making it possible to process access requests more flexibly and improve the protection efficiency of the target file.

[0119] In some implementations, after step 104, the following steps may also be included:

[0120] The first access flow information collected on the associated file and the second access flow information collected on the target file are obtained during the execution of the target business in the historical time period.

[0121] Model training is performed based on the first access traffic information and the second access traffic information to obtain a traffic prediction model.

[0122] The second access traffic information can be used as the prediction target of the model for model training, that is, the trained traffic prediction model can output the corresponding second access traffic information according to the input first access traffic information. The first access traffic information can be used as a training set, and the second access traffic information can be used as a verification set.

[0123] It is understandable that the model training method in this embodiment can adopt commonly used prediction model training methods, specifically linear regression, decision tree, neural network and other methods, so they will not be described in detail here.

[0124] When the current access flow information of the associated file is obtained, the access flow of the target file is predicted using the flow prediction model to obtain the predicted access flow information.

[0125] The target access address of the target file is obtained, and the current access flow information of the target file is detected according to the initiating address and the target access address.

[0126] The current access flow information of the target file is compared with the predicted access flow information to obtain the flow information error.

[0127] Exemplarily, the difference between the current access traffic information and the predicted access traffic information may be determined as the traffic information error.

[0128] If the traffic information error exceeds the information error threshold, the access initiator's access rights to the target file are closed.

[0129] In this embodiment, the current access traffic information of the target file is compared with the predicted access traffic information to obtain the traffic information error. If the traffic information error exceeds the information error threshold, the access permission of the access initiator to the target file is closed, so that the target file can be accurately protected in real time to prevent the target file from being illegally accessed.

[0130] The first access traffic information includes the first access traffic at multiple moments, and the second access traffic information includes the second access traffic at multiple moments. The specific implementation of the step of "training the model based on the first access traffic information and the second access traffic information to obtain the traffic prediction model" may include:

[0131] A first traffic curve is generated based on first access traffic at multiple moments, and a second traffic curve is generated based on second access traffic at multiple moments.

[0132] A first curve feature is extracted from the first flow curve, and a second curve feature is extracted from the second flow curve.

[0133] Optionally, the first curve feature and the second curve feature may include, but are not limited to, a curve contour image, a slope of each time period in the curve, an extreme value in the curve, and the like.

[0134] Model training is performed based on the first curve feature and the second curve feature to obtain a flow prediction model.

[0135] In this embodiment, a traffic prediction model is obtained by extracting the first curve feature from the first traffic curve, extracting the second curve feature from the second traffic curve, and performing model training based on the first curve feature and the second curve feature. In this way, more features in the reference traffic information and the access traffic information can be used for model training, thereby improving the accuracy of the traffic prediction model.

[0136] It can be seen that in this embodiment, by obtaining an access request for the target file, the access request carries the initiation address of the access initiator and the target business to be executed by the access initiator; then, the associated file related to the target file is determined according to the target business, wherein the associated file is a file that needs to be accessed together with the target file when the target business is executed; then, the access address of the associated file is obtained, and the access flow information of the access initiator to the associated file is detected according to the initiation address and the access address; if the access flow information meets the preset requirements, the access request is executed on the target file. Since users usually access different files when executing a business, the files required under the same business will have a certain correlation, so this embodiment determines whether the access to the target file is abnormal by detecting the access flow information of the associated file associated with the target file, thereby determining whether the target file can be accessed, which plays a good role in protecting the target file. Among them, since the access flow information is not easy to be tampered with, the protection strength is further improved. In addition, the operation of setting permissions for user information is avoided, which greatly improves the protection efficiency.

[0137] In this embodiment, if Figure 5 As shown, a big data-based information protection system is also provided, and the big data-based information protection system 300 includes:

[0138] A request acquisition module 310 is used to acquire an access request for a target file, wherein the access request carries an initiating address of an access initiator and a target service to be executed by the access initiator;

[0139] A determination module 320, configured to determine, according to the target service, an associated file related to the target file, wherein the associated file is a file that needs to be accessed together with the target file when the target service is executed;

[0140] The traffic detection module 330 is used to obtain the access address of the associated file, and detect the access traffic information of the access initiator to the associated file according to the initiation address and the access address;

[0141] The execution module 340 is used to execute the access request on the target file if the access flow information meets the preset requirements.

[0142] In some implementations, the execution module 340 is further configured to:

[0143] Obtain reference traffic information of the above-mentioned associated file corresponding to the above-mentioned target business;

[0144] Compare the access flow information with the reference flow information;

[0145] If the access traffic information matches the reference traffic information, it is determined that the access traffic information meets the preset requirements.

[0146] In some implementations, the reference traffic information includes reference traffic at multiple specified times, the access traffic information includes access traffic at multiple times, and the execution module 340 is further configured to:

[0147] If the multiple time periods include the multiple specified time periods, then the access traffic at the multiple specified time periods is filtered out from the access traffic at the multiple time periods;

[0148] For each of the plurality of designated moments, calculating a difference between a reference flow and an access flow corresponding to the plurality of designated moments, and obtaining a plurality of differences;

[0149] The absolute values ​​of the plurality of differences are added and then divided by the number of the plurality of differences to obtain a distance evaluation value;

[0150] If the distance evaluation value is less than or equal to the preset evaluation value, it is determined that the access traffic information matches the reference traffic information.

[0151] In some implementations, the execution module 340 is further configured to:

[0152] If the multiple time periods do not include the multiple specified time periods, generating an access flow curve according to the access flow at the multiple time periods, and generating a reference flow curve according to the reference flow at the multiple specified time periods;

[0153] Identify the inflection point of the access traffic curve, and divide the access traffic curve into a plurality of sub-traffic curves based on the inflection point, wherein each of the plurality of sub-traffic curves corresponds to a slope;

[0154] Obtain the target slope corresponding to each sub-flow curve and obtain a slope sequence;

[0155] If the slope sequence matches the reference traffic curve, it is determined that the access traffic information meets the preset requirements.

[0156] In some implementations, the execution module 340 is further configured to:

[0157] Obtain the time period corresponding to each of the above sub-flow curves to obtain multiple target time periods;

[0158] Obtaining multiple reference slopes corresponding to the multiple target time periods in the reference flow curve;

[0159] For each of the target time periods, the reference slope corresponding to the target time period is compared with the target slope to obtain the slope error corresponding to the target time period;

[0160] If the slope error corresponding to each of the target time periods does not exceed the error threshold, it is determined that the slope sequence matches the reference flow curve.

[0161] In some implementations, the execution module 340 is further configured to:

[0162] Obtain the number of curves of the above-mentioned multiple sub-flow curves;

[0163] If the number of the plurality of sub-flow curves matches the reference flow curve, the step of obtaining the slope corresponding to each sub-flow curve to obtain a slope sequence is performed.

[0164] In some embodiments, the system 300 further includes a prediction module, which is used to:

[0165] Acquire the first access flow information collected on the associated file and the second access flow information collected on the target file during the execution of the target business in a historical time period;

[0166] Performing model training based on the first access traffic information and the second access traffic information to obtain a traffic prediction model;

[0167] When the current access flow information of the associated file is obtained, the access flow of the target file is predicted using the flow prediction model to obtain the predicted access flow information;

[0168] Obtaining a target access address of a target file, and detecting current access traffic information of the target file according to the initiating address and the target access address;

[0169] Compare the current access flow information of the target file with the predicted access flow information to obtain a flow information error;

[0170] If the traffic information error exceeds the information error threshold, the access permission of the access initiator to the target file is closed.

[0171] In some implementations, the first access traffic information includes the first access traffic at multiple moments, and the second access traffic information includes the second access traffic at the multiple moments; the prediction module is specifically used to:

[0172] Generate a first traffic curve based on the first access traffic at multiple times, and generate a second traffic curve based on the second access traffic at the multiple times;

[0173] Extracting a first curve feature from the first flow curve, and extracting a second curve feature from the second flow curve;

[0174] Model training is performed based on the first curve feature and the second curve feature to obtain the traffic prediction model.

[0175] In some implementations, there are multiple associated files, and the multiple associated files are respectively stored in different nodes of a preset distributed system.

[0176] Based on the same aspect, the present disclosure also provides an electronic device, including:

[0177] a memory having a computer program stored thereon;

[0178] A processor is used to execute the above-mentioned computer program in the above-mentioned memory to implement the steps of any one of the above-mentioned information security protection methods based on big data in the above-mentioned embodiments.

[0179] Based on the above ideal embodiments of this application, the relevant staff can make various changes and modifications without departing from the technical concept of this application through the above description. The technical scope of this application is not limited to the content in the specification, and its technical scope must be determined according to the scope of the claims.

[0180] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for information security protection based on big data, characterized in that: include: Obtaining an access request for a target file, the access request carrying an initiating address of an access initiator and a target service to be executed by the access initiator; Determine, according to the target service, an associated file related to the target file, wherein the associated file is a file that needs to be accessed together with the target file when the target service is executed; Acquire the access address of the associated file, and detect the access flow information of the access initiator to the associated file according to the initiation address and the access address; If the access flow information meets the preset requirement, executing the access request on the target file; Before executing the access request on the target file if the access flow information meets the preset requirement, the method further includes: Obtaining reference traffic information of the associated file corresponding to the target service; Comparing the access flow information with the reference flow information; If the access flow information matches the reference flow information, it is determined that the access flow information meets the preset requirement; The reference traffic information includes reference traffic at multiple specified moments, the access traffic information includes access traffic at multiple moments, and before determining that the access traffic information meets a preset requirement if the access traffic information matches the reference traffic information, the method further includes: If the multiple moments include the multiple specified moments, filtering the access traffic at the multiple specified moments from the access traffic at the multiple moments; For each of the multiple specified time periods, calculating a difference between a reference flow rate and an access flow rate corresponding to the specified time period to obtain multiple difference values; Adding the absolute values ​​of the plurality of differences and dividing the sum by the number of the plurality of differences to obtain a distance evaluation value; If the distance evaluation value is less than or equal to a preset evaluation value, determining that the access flow information matches the reference flow information; The method further comprises: If the multiple moments do not include the multiple specified moments, generating an access flow curve according to the access flow at the multiple moments, and generating a reference flow curve according to the reference flow at the multiple specified moments; Identifying an inflection point of the access traffic curve, and dividing the access traffic curve into a plurality of sub-traffic curves based on the inflection point, wherein each of the plurality of sub-traffic curves corresponds to a slope; Obtain the target slope corresponding to each sub-flow curve and obtain a slope sequence; If the slope sequence matches the reference traffic curve, it is determined that the access traffic information meets the preset requirement; Before determining that the access traffic information meets a preset requirement if the slope sequence matches the reference traffic curve, the method further includes: Obtaining a time period corresponding to each sub-flow curve to obtain a plurality of target time periods; Acquire multiple reference slopes corresponding to the multiple target time periods in the reference flow curve; For each target time period, comparing the reference slope corresponding to the target time period with the target slope to obtain a slope error corresponding to the target time period; If the slope error corresponding to each of the target time periods does not exceed the error threshold, determining that the slope sequence matches the reference flow curve; Before obtaining the slope corresponding to each sub-flow curve to obtain the slope sequence, the method further includes: Obtaining the number of curves of the plurality of sub-flow curves; If the number of curves of the plurality of sub-flow curves matches the reference flow curve, the step of acquiring the slope corresponding to each sub-flow curve to obtain a slope sequence is performed.

2. The information security protection method based on big data according to claim 1 is characterized in that: After executing the access request on the target file if the access flow information meets the preset requirement, the method further includes: Acquire the first access flow information collected on the associated file and the second access flow information collected on the target file during the execution of the target business in a historical time period; Performing model training based on the first access traffic information and the second access traffic information to obtain a traffic prediction model; When the current access flow information of the associated file is obtained, the access flow of the target file is predicted using the flow prediction model to obtain predicted access flow information; Obtaining a target access address of a target file, and detecting current access flow information of the target file according to the initiating address and the target access address; Comparing the current access flow information of the target file with the predicted access flow information to obtain a flow information error; If the flow information error exceeds the information error threshold, the access permission of the access initiator to the target file is closed.

3. The information security protection method based on big data according to claim 2 is characterized in that: The first access traffic information includes first access traffic at multiple moments, the second access traffic information includes second access traffic at the multiple moments, and the model training is performed based on the first access traffic information and the second access traffic information to obtain a traffic prediction model, including: Generate a first traffic curve based on first access traffic at multiple moments, and generate a second traffic curve based on second access traffic at the multiple moments; extracting a first curve feature from the first flow curve, and extracting a second curve feature from the second flow curve; Model training is performed based on the first curve feature and the second curve feature to obtain the flow prediction model.

4. The information security protection method based on big data according to any one of claims 1 to 3, characterized in that: There are multiple associated files, and the multiple associated files are respectively stored in different nodes of the preset distributed system.

Images