A method and system for intelligent control of security network information based on big data

Abstract

The present invention relates to the field of network information transmission technology, and in particular to a method and system for intelligent control of secure network information based on big data. The method comprises the following steps: obtaining network information access data and network access address data; transmitting the network information access data to a network information control cloud for access information feature recognition to generate access information feature data; performing device identification based on the access information feature data to generate a network information access device; performing suspicious address detection on the network access address data to generate a normal network access address and a suspicious network access address; performing abnormal address behavior analysis on the suspicious network access address to generate abnormal network access address data and perform address imprisonment; and obtaining access device environment data. The present invention improves control efficiency and security through big data analysis, intelligent control, network security detection, device environment monitoring, and control delay optimization.

Description

Technical Field

[0001] The present invention relates to the technical field of network information transmission, and in particular to a method and system for intelligent control of secure network information based on big data. Background Art

[0002] With the popularization of the Internet, the amount of information is growing exponentially, and the network structure is becoming more and more complex. In this context, traditional network management methods can no longer meet the needs of real-time and intelligence. Therefore, we began to explore the use of big data technology to process and analyze massive amounts of network data to achieve intelligent management of network information. With the development of cloud computing and Internet of Things technology, the number of devices connected to the network has increased dramatically, which has led to further complexity of the network topology. Traditional network management methods are often static and rule-based, and cannot adapt to the dynamic changes of network topology. Therefore, the intelligent control method of secure network information based on big data has begun to receive attention. It can use real-time data analysis and machine learning algorithms to automatically identify and respond to abnormal situations in the network, and dynamically adjust the network configuration to optimize performance. With the rapid development of artificial intelligence and machine learning technologies, people have begun to try to apply these technologies to the field of network management. The intelligent control method of secure network information based on big data can not only realize real-time monitoring and optimization of network performance, but also improve the security and reliability of the network. However, traditional control often cannot effectively identify and handle suspicious behaviors in network access, resulting in increased network security risks. At the same time, the lack of evaluation and analysis of the complexity of device control leads to insufficient precision in the setting of control permissions, resulting in low control efficiency and security. Summary of the invention

[0003] Based on this, it is necessary to provide a method and system for intelligent control of security network information based on big data to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a method for intelligent control of security network information based on big data is provided, the method comprising the following steps:

[0005] Step S1: Acquire network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition to generate access information feature data; perform device identification based on the access information feature data to generate a network information access device;

[0006] Step S2: Perform suspicious address detection on the network access address data to generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on the suspicious network access addresses to generate abnormal network access address data and perform address imprisonment;

[0007] Step S3: Acquire access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; perform control complexity evaluation on device control instructions using access device environment data to generate device control complexity data; perform control authority division on device control instructions based on device control complexity data to generate device control authority;

[0008] Step S4: Monitor the response control data of the network information access device according to the device control authority to generate response control monitoring data; perform control delay analysis on the response control monitoring data to generate response control delay data; optimize the network information control delay based on the response control delay data to perform intelligent control operations for secure network information based on big data.

[0009] The present invention can realize real-time monitoring and identification of network information and timely discover abnormal situations by transmitting network information to the control cloud for feature recognition. Device identification based on access information feature data can realize refined management of network information access devices, thereby improving the accuracy and efficiency of management. Suspicious address detection and abnormal behavior analysis of network access addresses, and imprisonment, help improve network security and prevent malicious attacks and illegal access. Through complexity evaluation and authority segmentation of device control instructions, the access rights of devices can be controlled more finely, and the flexibility and security of network management can be improved. Monitoring and delay analysis of device control data and optimization can reduce control delays and improve the response speed and efficiency of network information control. The entire process is based on big data technology, which can realize intelligent network information control, automatically identify and respond to various situations in the network, and improve the intelligent level of management. Therefore, the present invention improves control efficiency and security through big data analysis, intelligent control, network security detection, device environment monitoring and control delay optimization.

[0010] In this specification, a security network information intelligent control system based on big data is provided, which is used to execute the above-mentioned security network information intelligent control method based on big data. The security network information intelligent control system based on big data includes:

[0011] The device association module is used to obtain network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition and generate access information feature data; perform device identification based on the access information feature data and generate a network information access device;

[0012] The address detection module is used to perform suspicious address detection on network access address data, generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on suspicious network access addresses, generate abnormal network access address data and perform address imprisonment;

[0013] The control interconnection module is used to obtain access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; use access device environment data to evaluate the control complexity of device control instructions to generate device control complexity data; divide the control authority of device control instructions based on the device control complexity data to generate device control authority;

[0014] The control response module is used to monitor the response control data of the network information access device according to the device control authority and generate the response control monitoring data; perform control delay analysis on the response control monitoring data and generate the response control delay data; optimize the network information control delay based on the response control delay data to perform the intelligent control operation of secure network information based on big data.

[0015] The beneficial effect of the present invention is that by performing feature recognition, anomaly detection and behavior analysis on network access data and addresses, malicious network behaviors can be effectively identified and prevented, and the level of network security can be improved. Device identification and control authority segmentation based on access information feature data can realize personalized management and refined control of devices, and improve device utilization efficiency and safety. The response speed and efficiency of network information control can be improved by evaluating the control complexity and authority segmentation of device control instructions, as well as analyzing and optimizing the delay of response control monitoring data. By collecting and analyzing a large amount of network information data, more accurate and comprehensive data support can be provided to decision makers, and intelligent network information control decisions based on big data can be realized. The execution of the entire process can effectively optimize the network information control delay, improve the performance and stability of the system, and thus provide users with more efficient and reliable network services. Therefore, the present invention improves control efficiency and safety through big data analysis, intelligent control, network security detection, device environment monitoring and control delay optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of the steps of a method for intelligent control of security network information based on big data;

[0017] Figure 2 for Figure 1 Detailed implementation steps of step S2 in the flowchart;

[0018] Figure 3 for Figure 1 Detailed implementation steps of step S3 in FIG.

[0019] Figure 4 for Figure 1 Detailed implementation steps of step S4 in FIG.

[0020] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0022] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0023] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0024] To achieve this, please refer to Figures 1 to 4 , a method for intelligent control of security network information based on big data, the method comprising the following steps:

[0025] Step S1: Acquire network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition to generate access information feature data; perform device identification based on the access information feature data to generate a network information access device;

[0026] Step S2: Perform suspicious address detection on the network access address data to generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on the suspicious network access addresses to generate abnormal network access address data and perform address imprisonment;

[0027] Step S3: Acquire access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; perform control complexity evaluation on device control instructions using access device environment data to generate device control complexity data; perform control authority division on device control instructions based on device control complexity data to generate device control authority;

[0028] Step S4: Monitor the response control data of the network information access device according to the device control authority to generate response control monitoring data; perform control delay analysis on the response control monitoring data to generate response control delay data; optimize the network information control delay based on the response control delay data to perform intelligent control operations for secure network information based on big data.

[0029] The present invention can realize real-time monitoring and identification of network information and timely discover abnormal situations by transmitting network information to the control cloud for feature recognition. Device identification based on access information feature data can realize refined management of network information access devices, thereby improving the accuracy and efficiency of management. Suspicious address detection and abnormal behavior analysis of network access addresses, and imprisonment, help improve network security and prevent malicious attacks and illegal access. Through complexity evaluation and authority segmentation of device control instructions, the access rights of devices can be controlled more finely, and the flexibility and security of network management can be improved. Monitoring and delay analysis of device control data and optimization can reduce control delays and improve the response speed and efficiency of network information control. The entire process is based on big data technology, which can realize intelligent network information control, automatically identify and respond to various situations in the network, and improve the intelligent level of management. Therefore, the present invention improves control efficiency and security through big data analysis, intelligent control, network security detection, device environment monitoring and control delay optimization.

[0030] In the embodiment of the present invention, reference Figure 1 The above is a schematic diagram of the steps of a method for intelligently controlling security network information based on big data of the present invention. In this example, the method for intelligently controlling security network information based on big data includes the following steps:

[0031] Step S1: Acquire network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition to generate access information feature data; perform device identification based on the access information feature data to generate a network information access device;

[0032] In an embodiment of the present invention, data of network activities and related network access address data are collected, specifically through network logs, monitoring equipment or other network security tools. The collected data is transmitted to a network information control cloud, specifically a cloud server or service, for further processing and analysis of the data. Data analysis and processing are performed in the cloud to identify features in the access information, including access time, access source, access destination, access type, etc., and these feature data are extracted and recorded. Based on the feature data obtained by the analysis, the device that performs the access is identified and recognized for further tracking and management. Based on the device identification and other information, a record or data of the network information access device is generated, which can be used to monitor network activities, identify abnormal behavior, etc.

[0033] Step S2: Perform suspicious address detection on the network access address data to generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on the suspicious network access addresses to generate abnormal network access address data and perform address imprisonment;

[0034] In the embodiment of the present invention, a black and white list database containing known malicious addresses and legal addresses is established. A series of rules are defined to identify suspicious network access addresses, such as specific URL patterns, IP address ranges, etc. The network access address is extracted from the network access log or traffic data. The network access address is matched with the black and white list and marked as a normal or suspicious address. The behavior of the network access address is evaluated and analyzed by using machine learning, statistical analysis and other technologies. Anomaly detection algorithms, such as outlier detection and cluster analysis, are applied to identify network access addresses with abnormal behavior. Access logs, request data and other related information of suspicious network access addresses are collected. Based on the behavior analysis technology, features such as access frequency, access mode, and request type are extracted. Using machine learning or statistical analysis algorithms, an abnormal behavior model is established, and suspicious addresses are classified as abnormal or normal. Based on the results of abnormal behavior analysis, the abnormal network access address is identified as an address that needs to be imprisoned. The abnormal address data is stored in a database or cloud environment for subsequent address imprisonment operations. Firewalls or network devices are configured, blocking rules are set, and the IP addresses of abnormal addresses are blocked. Additional verification is performed on the access to abnormal addresses, requiring users to provide additional identity authentication information.

[0035] Step S3: Acquire access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; perform control complexity evaluation on device control instructions using access device environment data to generate device control complexity data; perform control authority division on device control instructions based on device control complexity data to generate device control authority;

[0036] In an embodiment of the present invention, by collecting network information of the access device, including device type, operating system version, network connection attributes, etc., feature information related to device control, such as device identity, hardware configuration, software version, etc., is extracted, and the basic information of the access device is obtained through a network protocol or API interface, and the network connection attributes and environmental configuration of the device are analyzed to obtain the feature data of the device. A cloud control platform is established for communicating and controlling the access device. A protocol for communicating with the access device, such as MQTT, HTTP, etc., is defined. A cloud control channel is established between the access device and the cloud control platform based on a normal network access address. Device control instructions are generated on the cloud control platform, including operation commands, parameter settings, etc. An evaluation model is established for analyzing the complexity of device control instructions. Environmental data of the access device is analyzed, such as device characteristics, network connection attributes, etc. Based on the access device environmental data, the device control instructions are input into the control complexity evaluation model. The evaluation model analyzes the complexity of the control instructions, considering the influence of device characteristics and environmental attributes. Device control complexity data is generated for subsequent control authority segmentation. A strategy is defined for performing authority segmentation on control instructions based on the device control complexity data. Use access control technologies, such as access tokens and role permissions, to manage device control permissions. Based on device control complexity data, formulate a control permission segmentation strategy to divide control instructions into different permission levels. Establish an access control mechanism to assign corresponding access rights to each permission level. Authenticate visitors based on access device environment data, and grant corresponding device control permissions based on their identity and permission level.

[0037] Step S4: Monitor the response control data of the network information access device according to the device control authority to generate response control monitoring data; perform control delay analysis on the response control monitoring data to generate response control delay data; optimize the network information control delay based on the response control delay data to perform intelligent control operations for secure network information based on big data.

[0038] In an embodiment of the present invention, the response control data of the network information access device is collected, including the device response time, resource utilization, etc. A data storage and processing system is established to store and process the response control monitoring data. The response control data of the network information access device is monitored, and the response time, resource consumption, and other information of the device are recorded. The response control monitoring data is stored in the data storage system to provide a data basis for subsequent control delay analysis. According to the response control monitoring data, the control delay analysis algorithm is applied to calculate the response control delay of the device. The monitoring data is processed by using big data processing and computing technology to extract delay-related features and indicators. Response control delay data is generated, including information such as average delay, maximum delay, and delay distribution. Based on the response control delay data, the control delay optimization algorithm is applied to optimize the control delay of the network information. According to the optimization results, the control strategy, resource allocation, etc. are adjusted to reduce the control delay of the network information. The intelligent control system is used to execute the optimized network information control operation to realize the intelligent control of the network information.

[0039] Preferably, step S1 comprises the following steps:

[0040] Step S11: Acquire network information access data and network access address data;

[0041] Step S12: performing data cleaning on the network information access data to generate network information access cleaned data; performing data missing value filling on the network information access cleaned data to generate network information access filled data;

[0042] Step S13: performing data outlier detection on the network information access filling data to generate network information access data outliers; performing logarithmic transformation on the network information access data outliers to generate network information access repair data;

[0043] Step S14: standardize the network information access repair data to generate standard network information access data; transmit the network information access data to the network information control cloud for user identity matching to generate user identity information data;

[0044] Step S15: performing access information feature recognition on the network information access data based on the user identity information data to generate access information feature data; performing device identification based on the access information feature data to generate a network information access device.

[0045] The present invention obtains network information access data and network access address data. This step is to collect data of network activities and related network access address information. The network information access data is cleaned and network information access cleaned data is generated. In this step, the collected network information is cleaned, unnecessary data or noise is removed, and cleaned data is generated. Then, missing values ​​are filled in the cleaned data to generate network information access filling data to ensure the integrity and accuracy of the data. Data outlier detection is performed on the network information access filling data, and network information access data outliers are generated. This step is to identify and process outliers or abnormal values ​​in the data to ensure the quality and reliability of the data. Then the identified outliers are logarithmically transformed to generate network information access repair data for subsequent processing. Data standardization is performed on the network information access repair data to generate standard network information access data, and it is transmitted to the network information control cloud for user identity matching to generate user identity information data. In this step, the repaired data is standardized to ensure the consistency and comparability of the data. Then the standardized data is transmitted to the cloud for user identity matching to generate user identity information data for subsequent analysis and identification. Based on the user identity information data, the network information access data is identified for access information features and access information feature data is generated. This step is to further analyze and process the network access data based on the user identity information data, identify the feature information therein, and generate the corresponding feature data. Then, based on these feature data, the device is identified and the network information access device is generated for further behavior analysis and identification.

[0046] In the embodiment of the present invention, network information access data including access time, access content, etc. are obtained by using network monitoring tools such as Wireshark, tcpdump, etc. Network access address data including source IP address, target IP address, etc. are obtained by using network traffic analyzers such as Bro, Snort, etc. Network information access data is recorded by using network monitoring tools, such as capturing network data packets such as HTTP requests and database access. Network data packets are captured by using a network traffic analyzer to extract network access address data such as source IP address and target IP address. Data cleaning algorithms are used to deduplicate network information access data and remove duplicate access records. Network information access data is de-noised, for example, by filtering out abnormal values ​​or noise data. Missing values ​​in network information access cleaning data are filled using a missing value filling algorithm, for example, using mean filling or interpolation filling. Outlier detection algorithms, such as Z-Score based on statistical methods and KNN based on distance, are used to perform outlier detection on network information access filling data to identify abnormal access data. Apply logarithmic transformation to outliers in network information access data, such as taking logarithms or logarithmic differences, to better handle outliers and generate network information access repair data. Use data standardization methods, such as Z-Score standardization, minimum-maximum normalization, etc., to standardize network information access repair data and convert each feature value into a standard score. Transmit the standardized network information access data to the network information control cloud, match it with the user identity through the identity matching algorithm, and generate user identity information data, such as user ID, user attributes, etc. Based on the user identity information data, use machine learning algorithms or pattern recognition methods to extract and identify features of network information access data, and extract feature data of access information, such as access frequency, access time, access content, etc. Based on the access information feature data, use the device identification algorithm to identify and classify network information access devices, and classify them according to the characteristics and behaviors of the devices, for example, classify the devices into different types of access devices such as computers, mobile phones, and tablets.

[0047] Preferably, step S15 comprises the following steps:

[0048] Step S151: dividing the access rights of the network information access data based on the user identity information data to generate network access rights data, wherein the access rights division includes read-only rights and operable rights;

[0049] Step S152: Analyze the access device address characteristics of the network information access data according to the network access permission data to obtain access information characteristic data;

[0050] Step S153: constructing a network transmission channel for the access information feature data and the network access address data based on the network protocol technology to generate a network transmission channel; performing device matching on the access information feature data using the network transmission channel to generate network information device matching data;

[0051] Step S154: uniquely identify the network information device matching data, thereby obtaining a network information matching device identification code; perform remote network access to the device through the network information matching device identification code, and generate a network information access device.

[0052] The present invention can ensure that network information is only accessed by authorized users or roles by dividing access rights based on user identity information data, thereby improving the security and confidentiality of information. By analyzing network access rights data, the characteristics and behaviors of network access devices can be understood, which helps to identify abnormal access or security threats. Building a network transmission channel based on network protocol technology can ensure the secure transmission of access information and prevent information from being stolen or tampered with. By matching and identifying access information feature data and network access address data, the source device of the access information can be determined, providing convenience for further network security management and troubleshooting. By matching device identification codes with network information for remote network access to devices, remote management and monitoring of network devices can be achieved, improving the efficiency and flexibility of network management.

[0053] In an embodiment of the present invention, the network information access data is divided into permissions by using an access permission division algorithm according to user identity information data. For example, permissions are divided according to user roles or user groups, and some users are identified as read-only permissions, while other users are identified as operable permissions. Based on the network access permission data, the network information access data is analyzed for access device address characteristics. For example, according to the operable permissions in the network access permission data, the number, frequency, geographical location and other characteristics of the access device address are analyzed. Based on network protocol technology, a network transmission channel is constructed for data transmission and communication. For example, TCP / IP protocol is used for data transmission. The access information feature data is transmitted to a specified network access address using the network transmission channel. At the same time, the access information feature data is matched with a device using a device matching algorithm, and the access information feature data is associated with the network access address data. The network information device matching data is processed using a unique device identification algorithm to generate a unique network information matching device identification code. For example, a hash algorithm is used to encrypt the device information to generate a unique identification code. Using the network information matching device identification code, remote network access is performed on the device through remote network access technology, thereby obtaining the network information access device. For example, remote access is performed through the SSH (Secure Shell) protocol.

[0054] Preferably, step S2 comprises the following steps:

[0055] Step S21: matching the network access address data with the preset access address whitelist by address IP. When the matching result between the network access address data and the preset access address whitelist is true, the corresponding network access address data is marked as a normal network access address; when the matching result between the network access address data and the preset access address whitelist is false, the corresponding network access address data is marked as a suspicious network access address.

[0056] Step S22: the suspicious network access address data is matched with a preset access address blacklist. When the matching result between the network access address data and the preset access address blacklist is true, the corresponding suspicious network access address is permanently blocked.

[0057] Step S23: when the matching result between the network access address data and the preset access address blacklist is false, a suspicious address behavior detection is performed on the suspicious network access address to obtain suspicious address behavior data;

[0058] Step S24: classify the suspicious network access addresses into an address list according to the suspicious address behavior data, and return to step S21 until a normal network access address is obtained, wherein the address list includes a preset access address white list and a preset access address black list.

[0059] The present invention can accurately identify normal network access addresses by matching network access address data with a preset access address whitelist, thereby reducing the false alarm rate and improving the credibility of the system. For suspicious network access addresses that match the preset access address blacklist, permanent address banning is immediately performed, which can quickly and effectively prevent potential security threats and improve the security of the network. For suspicious network access addresses that are not matched to the blacklist, suspicious address behavior detection is performed, which helps to further identify potential abnormal behaviors and provide a basis for subsequent security processing. Suspicious network access addresses are classified according to suspicious address behavior data, and the preset access address blacklist is dynamically adjusted to reflect the latest security threats and attack patterns, thereby improving the system's adaptability and response capabilities. By continuously detecting, banning and adjusting suspicious addresses, potential network attacks and malicious behaviors can be prevented in a timely manner, thereby reducing the security risks faced by the network system.

[0060] As an example of the present invention, refer to Figure 2 As shown, in this example, step S2 includes:

[0061] Step S21: matching the network access address data with the preset access address whitelist by address IP. When the matching result between the network access address data and the preset access address whitelist is true, the corresponding network access address data is marked as a normal network access address; when the matching result between the network access address data and the preset access address whitelist is false, the corresponding network access address data is marked as a suspicious network access address.

[0062] In an embodiment of the present invention, the network access address data is matched with the preset access address whitelist by address IP. For example, the CIDR (Classless Inter-Domain Routing) method is used for matching to determine whether the network access address is within the preset access address whitelist. When the network access address data matches the preset access address whitelist and the result is true, the corresponding network access address data is marked as a normal network access address. This means that the address is considered to be legal and trustworthy. When the network access address data matches the preset access address whitelist and the result is false, the corresponding network access address data is marked as a suspicious network access address, which means that the address has an abnormality or potential security risk.

[0063] Step S22: the suspicious network access address data is matched with a preset access address blacklist. When the matching result between the network access address data and the preset access address blacklist is true, the corresponding suspicious network access address is permanently blocked.

[0064] In the embodiment of the present invention, the suspicious network access address data is matched with the preset access address blacklist. For example, the IP address is matched using the CIDR method to determine whether the suspicious network access address is within the access address blacklist. When the suspicious network access address data matches the preset access address blacklist and the result is true, the address blocking measure is taken to permanently block the suspicious network access address. This means that the address will be prohibited from accessing network resources to protect the security and integrity of the system.

[0065] Step S23: when the matching result between the network access address data and the preset access address blacklist is false, a suspicious address behavior detection is performed on the suspicious network access address to obtain suspicious address behavior data;

[0066] In an embodiment of the present invention, when the result of matching the network access address data with the preset access address blacklist is false, it means that the network access address is not in the blacklist and is a suspicious address. Suspicious address behavior detection is required. Suspicious network access addresses are analyzed and detected using a suspicious address behavior detection algorithm to identify whether their behavior patterns are abnormal or suspicious. The access behavior of suspicious addresses is analyzed, such as access frequency, requested target resources, data transmission volume, etc. By establishing a model of normal behavior, it is detected whether the behavior of the suspicious address is significantly different from the normal behavior. Compare with the threat intelligence database to check whether the suspicious address is associated with known malicious behavior or hacker activities, and generate suspicious address behavior data based on the analysis results.

[0067] Step S24: classify the suspicious network access addresses into an address list according to the suspicious address behavior data, and return to step S21 until a normal network access address is obtained, wherein the address list includes a preset access address white list and a preset access address black list.

[0068] In an embodiment of the present invention, suspicious network access addresses are classified by using suspicious address behavior data as input through an address list classification algorithm. If the suspicious address is classified as an address in a preset access address whitelist, it means that the address is a normal network access address and no further processing is required, and the process directly returns to step S21. If the suspicious address is classified as an address in a preset access address blacklist, it means that the address is a prohibited access address and the permanent address blocking measures in step S22 are executed. If the suspicious address is neither in the whitelist nor in the blacklist, further analysis or manual intervention is required to determine its legitimacy or risk. It can be marked as a suspicious address and subsequent processing or decision-making is performed.

[0069] Preferably, step S23 includes the following steps:

[0070] Step S231: when the matching result between the network access address data and the preset access address blacklist is false, a historical access address analysis is performed on the suspicious network access address to generate a historical suspicious access address;

[0071] Step S232: Analyze the access address area range of the historical suspicious access address and the suspicious network access address to generate the historical suspicious network access address area range and the suspicious network access address area range; overlap the address range of the historical suspicious network access address area range and the suspicious network access address area range. When the historical suspicious network access address area range and the suspicious network access address area range overlap, perform IP fraud detection on the suspicious network access address to generate suspicious address fraud detection data;

[0072] Step S233: When the historical suspicious network access address area range does not overlap with the suspicious network access address area range, a proxy server detection is performed on the suspicious network access address to generate suspicious network access real address data;

[0073] Step S234: Integrate abnormal behaviors based on the suspicious address fraud detection data and the suspicious network access real address data to obtain suspicious address behavior data.

[0074] By analyzing the historical access records of suspicious network access addresses, the present invention can understand their past behavior patterns and access trends, which helps to identify abnormal or suspicious access behaviors. Analyzing the area range of historical suspicious access addresses and current suspicious access addresses and performing overlap analysis can help discover fraudulent behaviors, such as the use of false IP addresses. When the area range of historical suspicious access addresses and the area range of suspicious access addresses overlap, IP fraud detection is performed to identify potential fraudulent behaviors to prevent network attacks or illegal access. For situations where there is no overlap, a proxy server detection is performed on the suspicious network access address to identify whether access is made through a proxy server to determine whether there is hidden access behavior. Based on the suspicious address fraud detection data and the suspicious network access real address data, the abnormal behavior is integrated and analyzed to further confirm the authenticity and potential threats of the suspicious address, providing a basis for subsequent security processing.

[0075] In the embodiment of the present invention, when the network access address data matches the preset access address blacklist and the result is false, it indicates that the address is not in the blacklist and is a suspicious address. Historical access address analysis is required. The suspicious network access address is analyzed using the historical access address data analysis algorithm to study past access patterns, access frequencies, requested resources and other information. Based on the historical access address data analysis results, a historical suspicious access address is generated for further analysis or decision-making. The address area range of the historical suspicious access address and the suspicious network access address is analyzed to determine their geographical location or network range. The historical suspicious network access address area range is compared with the suspicious network access address area range to determine whether there is overlap. When the historical suspicious network access address area range and the suspicious network access address area range overlap, the IP fraud detection algorithm is executed to analyze the suspicious network access address to generate suspicious address fraud detection data. When the historical suspicious network access address area range and the suspicious network access address area range do not overlap, it indicates that the suspicious network access address uses a proxy server for access. The suspicious network access address is analyzed using a proxy server detection algorithm to determine whether a proxy server is used. When a suspicious network access address is found to use a proxy server, the suspicious network access real address data is generated, that is, the real access address after passing through the proxy server. Based on the suspicious address fraud detection data and the suspicious network access real address data, these data are integrated using the abnormal behavior integration algorithm. The integration results may include but are not limited to: abnormal access frequency, abnormal access mode, sensitive resources accessed, etc. Based on the integrated suspicious address behavior data, subsequent processing, decision-making or alarm is carried out.

[0076] Preferably, step S3 comprises the following steps:

[0077] Step S31: Obtain access device environment data;

[0078] Step S32: Based on the normal network access address, the network information access device is interconnected with the cloud to generate a device control instruction;

[0079] Step S33: Decomposing the device control instruction by using the access device environment data to generate device access control instruction decomposition data, wherein the device access control instruction decomposition data includes instruction type data, control parameters and operation action data;

[0080] Step S34: evaluating the complexity of command manipulation according to the command type data, control parameters and operation action data, and generating device control complexity data;

[0081] Step S35: dividing the control authority of the device control instruction based on the device control complexity data to generate device control authority.

[0082] The present invention obtains environmental data related to the access device, including information such as device type, network status, hardware configuration, etc., to provide a basis for subsequent control instruction generation and authority management. Based on the normal network access address, the network information access device is connected to the cloud for control, and device control instructions are generated to control the behavior or operation of the device. The device control instructions are decomposed using the access device environment data to generate device access control instruction decomposition data to determine the type, parameters and operation actions of the control instructions. Based on the instruction type data, control parameters and operation action data, the control complexity of the control instructions is evaluated to determine the control difficulty and risk level of the device. Based on the device control complexity data, the device control instructions are divided into permissions to determine the control permissions of different users or roles to ensure the safe and stable operation of the device.

[0083] As an example of the present invention, refer to Figure 3 As shown, in this example, step S3 includes:

[0084] Step S31: Obtain access device environment data;

[0085] In an embodiment of the present invention, the operating system information of the device is extracted by parsing the user agent string. The user agent string is a piece of text sent by a browser or application to a server, which contains information about the device, such as the operating system, browser type, etc. By parsing the user agent string, the operating system information of the device can be extracted. For example: the user agent string is "Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 80.0.3987.132 Safari / 537.36", and through parsing, it can be obtained that the device operating system is Windows 10. Through the JavaScript programming language, the API provided by the browser can be used to obtain the hardware information of the device. For example, the width and height of the screen can be obtained by using window.screen.width and window.screen.height, the model of the device can be obtained by using navigator.userAgent, and the number of CPU cores can be obtained by using navigator.hardwareConcurrency. The network information of the device, including the IP address, network type, etc., is obtained by using the WebRTC (Web Real-Time Communication) API. WebRTC is a set of browser APIs for implementing real-time communication functions, which includes the function of obtaining device network information. By calling the WebRTC API, you can obtain the device's IP address, network type (such as Wi-Fi, cellular network) and other information. Use the Geolocation API to obtain the device's location information, including longitude and latitude, geographic location, etc. The Geolocation API is an API provided by the browser to obtain the device's geographic location information. By calling the Geolocation API, you can obtain the device's longitude and latitude coordinates, geographic location name and other information.

[0086] Step S32: Based on the normal network access address, the network information access device is interconnected with the cloud to generate a device control instruction;

[0087] In an embodiment of the present invention, a communication connection between the cloud and the device is established by using the MQTT protocol. MQTT is a lightweight communication protocol based on the publish / subscribe mode, which is suitable for communication between IoT devices and the cloud. The cloud establishes a connection with the device through the MQTT protocol to transmit and receive control instructions. For example, the cloud uses the MQTT protocol to connect to the IP address and port of the device and establish a stable communication connection. The control instructions are sent to the device using the RESTful API through the HTTP protocol. The RESTful API is an architectural style based on the HTTP protocol and is used for the design and communication of network services. The cloud sends a control instruction to the device by sending an HTTP request and calling the RESTful API interface of the device. For example, the cloud sends an HTTP POST request to the device, the URL of the request is the control interface address of the device, and the request body contains the parameters of the control instruction. The WebSockets protocol is used to implement two-way real-time communication to receive device status feedback. The logic processing module of the cloud is used to generate device control instructions based on the received data.

[0088] Step S33: Decomposing the device control instruction by using the access device environment data to generate device access control instruction decomposition data, wherein the device access control instruction decomposition data includes instruction type data, control parameters and operation action data;

[0089] In the embodiment of the present invention, the received device control instruction is parsed by using a data parsing algorithm to extract the instruction type and control parameters therein. The parsing algorithm can extract the required data from the original instruction according to the format and agreed rules of the instruction. For example, for a device control instruction string "SET_TEMPERATURE=25", the parsing algorithm can extract the instruction type as "SET_TEMPERATURE" and the control parameter as "25". The access device environment data is processed and analyzed by a data analysis algorithm to extract the device environment characteristics therein. The analysis algorithm can obtain useful information based on the statistical characteristics of the device environment data, pattern recognition and other methods. For example, for the temperature information in the device environment data, the analysis algorithm can calculate the average temperature, temperature change trend and other characteristics. Based on the parsed instruction type data, device environment characteristics and control parameters, the device access control instruction decomposition data is generated by programming logic. The programming logic can integrate the parsed data into a format suitable for device access according to specific business needs and device characteristics. For example, assuming that the parsed instruction type is "SET_TEMPERATURE", the device environment characteristic is the current temperature of "28", and the control parameter is the set temperature of "25", then the generated device access control instruction decomposition data may include instruction type data of "SET_TEMPERATURE", control parameter of "25", and operation action data of "COOLING".

[0090] Step S34: evaluating the complexity of command manipulation according to the command type data, control parameters and operation action data, and generating device control complexity data;

[0091] In an embodiment of the present invention, an evaluation model is designed according to actual conditions and requirements to measure the control complexity of device control instructions. The evaluation model can be defined based on factors such as instruction type, control parameter range, and diversity of operating actions. For example, the evaluation model can set weights for different instruction types, the degree of influence of the value range of control parameters on complexity, etc., and use algorithms to calculate the control complexity of device control instructions. Based on the calculated control complexity data, further processing and storage are performed through programming logic. Processing may include normalization, grouping, and other operations on the data for subsequent use and analysis. For storage, appropriate data structures and databases may be selected to save the generated device control complexity data.

[0092] Step S35: dividing the control authority of the device control instruction based on the device control complexity data to generate device control authority.

[0093] In an embodiment of the present invention, a set of control authority rules are designed based on device control complexity data and specific security requirements to segment device control instructions. The rules can be defined based on factors such as the threshold of control complexity, user identity, device type, etc. The device control instructions are segmented according to the authority rules using an authority segmentation algorithm to generate corresponding device control permissions. The algorithm can assign instructions to different permission levels or user groups based on the conditions and logic defined in the authority rules, and use programming logic to process and store the segmented device control permissions.

[0094] Preferably, step S34 includes the following steps:

[0095] Step S341: performing instruction control type classification based on instruction type data to generate control type classification data; performing device control amplitude calculation on the operation action data using the control type classification data to obtain device control amplitude data;

[0096] Step S342: performing control parameter quantity analysis on the control parameters according to the device control amplitude data to generate the control parameter quantity;

[0097] Step S343: planning a control path for the device control amplitude data by controlling the number of parameters, generating device control path data, and synchronously recording the control duration to obtain device control time data;

[0098] Step S344: perform device control space complexity calculation on the device control path data to obtain the device control space complexity; perform device control time complexity calculation on the device control time data to obtain the device control time complexity; perform instruction complexity evaluation on the device control space complexity and the device control time complexity by using the entropy weight method to generate device control complexity data.

[0099] The present invention classifies control types according to instruction type data to distinguish different types of control instructions, providing a basis for subsequent complexity calculation and evaluation. The control type classification data is used to calculate the control amplitude of the operation action data to determine the amplitude of the control instruction, which is helpful to evaluate the complexity of the control instruction. The control parameters are quantitatively analyzed according to the device control amplitude data to determine the number of parameters involved in the control instruction to evaluate the complexity of the control instruction. The control path is planned for the device control amplitude data according to the number of control parameters to determine the execution path of the control instruction, and the control duration is recorded to calculate the device control time data. The device control space complexity is calculated for the device control path data, and the device control time complexity is calculated for the device control time data. The two are comprehensively evaluated by the entropy weight method to obtain the device control complexity data, which can objectively evaluate the complexity of the device control instruction, help optimize the design and execution of the control instruction, improve the stability and reliability of the system, and reduce the control errors and risks caused by complexity.

[0100] In an embodiment of the present invention, by analyzing and classifying the instruction type data, the instructions are divided according to their control types, for example, including state control, speed control, position control and other types. Based on the control type classification data, the operation action data is calculated according to the device control amplitude, and the amplitude of each control type is determined for subsequent control parameter analysis and path planning. According to the device control amplitude data, the number of control parameters required for each control type is analyzed, and the control path planning is performed accordingly to determine the device control path, and the control duration is recorded to obtain the device control time data. The spatial complexity of the device control path data is calculated, and the time complexity of the device control time data is calculated, and then the two complexities are comprehensively evaluated by the entropy weight method to generate the device control complexity data. This can include indicators such as the length of the calculation path, the degrees of freedom of the device movement, the number of control parameters, and weighted comprehensive evaluation.

[0101] Preferably, step S4 comprises the following steps:

[0102] Step S41: Performing hierarchical control on network information access devices according to device control authority, generating a hierarchical control strategy for devices; performing hierarchical control on devices based on the hierarchical control strategy, and monitoring control data through device sensors, thereby obtaining device control monitoring data;

[0103] Step S42: transmitting the device control monitoring data to the network information control cloud through the network transmission channel for control response, and generating response control monitoring data;

[0104] Step S43: performing control delay analysis on the response control monitoring data to generate response control delay data;

[0105] Step S44: Optimize the network information control delay based on the response control delay data to perform intelligent control operations for secure network information based on big data.

[0106] The present invention can effectively manage and limit the control permissions of different devices by performing hierarchical control on network information access devices according to device control permissions, thereby improving the security and controllability of the network information system. By using device sensors to monitor control data, it is possible to obtain the status and behavior data of the device in real time, detect abnormal situations in a timely manner and respond, which is helpful to prevent and deal with equipment failures or security threats. Transmitting monitoring data to the network information control cloud for control response can achieve remote monitoring and control, and improve the flexibility and responsiveness of the network information system. Control delay analysis of response control monitoring data helps to evaluate the response speed and efficiency of the system, reduce control delays by optimizing network communications and control algorithms, and improve the real-time and performance of the system. Intelligent control operations of secure network information based on big data can achieve intelligent management and optimization of network information systems by analyzing and optimizing response control delay data, combined with big data analysis and machine learning technology, and improve the system's adaptability and intelligence level.

[0107] As an example of the present invention, refer to Figure 4 As shown, in this example, step S4 includes:

[0108] Step S41: Performing hierarchical control on network information access devices according to device control authority, generating a hierarchical control strategy for devices; performing hierarchical control on devices based on the hierarchical control strategy, and monitoring control data through device sensors, thereby obtaining device control monitoring data;

[0109] In an embodiment of the present invention, the control authority levels of different devices, such as administrators, ordinary users, etc., are determined according to system requirements and security considerations. For each device, its functions and access requirements to network information are analyzed, including operations such as reading, writing, and modifying. According to the device control authority level and access requirements, a corresponding hierarchical control strategy is formulated to clarify the operations and access scopes that can be performed at different authority levels. According to the formulated hierarchical control strategy, the authority of each device is configured, and the corresponding access rights and control strategies are set. Through device sensors or monitoring software, the control data of the device is monitored in real time, including operation records, access status, etc., and the monitoring data is recorded. The control data obtained by the device sensor is collected and recorded, including device operation records, access rights changes, etc.

[0110] Step S42: transmitting the device control monitoring data to the network information control cloud through the network transmission channel for control response, and generating response control monitoring data;

[0111] In the embodiment of the present invention, by selecting a suitable network transmission channel according to the system requirements and network environment, it can be a local area network, a wide area network or the Internet. Establish a data transmission connection between the device control monitoring data and the network information control cloud to ensure that the data can be transmitted safely and stably. According to the needs and performance requirements of data transmission, select a suitable transmission protocol, such as HTTP, MQTT, WebSocket, etc. Use encryption, identity authentication and other security mechanisms to ensure the security and integrity of data during transmission. Develop or configure a data transmission program, which is responsible for transmitting the device control monitoring data from the device end to the network information control cloud. Configure the parameters of the transmission program, including the target cloud address, port number, transmission protocol, etc. Build a corresponding receiving program on the network information control cloud, which is responsible for receiving the transmitted device control monitoring data and parsing it. Generate a corresponding control response based on the received monitoring data, which can be to modify the device status, send an alarm notification, etc. Process and record the data generated by the control response, including the response time, response result, etc.

[0112] Step S43: performing control delay analysis on the response control monitoring data to generate response control delay data;

[0113] In an embodiment of the present invention, the generated response control monitoring data is obtained from the network information control cloud, and these data include the timestamp of the control response and other relevant information. The timestamp of each control response is analyzed to determine the time difference between the time when the control request is issued and the time when the response is returned, that is, the control delay. The control delay is divided into different types, such as transmission delay, processing delay, etc., so as to analyze the delay more finely. The collected control delay data is statistically analyzed and the statistical indicators such as the average value, maximum value, minimum value of the delay, and the distribution of the delay can be calculated. The influencing factors of the control delay, such as the network environment, server load, data processing speed, etc., are analyzed to facilitate the formulation of subsequent optimization measures. According to the delay analysis results, a response control delay data report is generated, including delay statistical indicators, delay distribution charts, etc. The delay data is recorded as a basis for system performance evaluation and optimization, which is convenient for subsequent improvements and adjustments.

[0114] Step S44: Optimize the network information control delay based on the response control delay data to perform intelligent control operations for secure network information based on big data.

[0115] In the embodiment of the present invention, the response control delay data is analyzed in detail, including the source, frequency, size and other aspects of the delay. The main problems and influencing factors that cause control delay, such as network transmission, data processing, server load, etc., are determined. According to the delay data analysis results, the optimization goals are clarified, such as reducing the average delay, reducing the delay fluctuation range, etc. According to the specific situation of the delay problem, the corresponding optimization strategy is formulated, including optimizing network transmission, improving server performance, improving data processing algorithms, etc. A faster and more stable network transmission protocol is adopted to optimize the network topology, reduce the transmission path, and improve the transmission efficiency. Increase server hardware resources, optimize server software configuration, and improve the processing power and response speed of the server. Optimize the data processing algorithm, reduce data processing time, and improve data processing efficiency, thereby reducing control delay. The formulated optimization plan is implemented in the network information control system, including updating software configuration, adjusting network settings, etc. The optimization effect is monitored in real time, and the delay data before and after optimization are compared to evaluate the significance and sustainability of the optimization effect. The operation data of the network information control system is collected and analyzed using big data technology, including control delay data, device status data, etc. Based on the analysis results, machine learning, data mining and other technologies are used to achieve intelligent control of network information, including automatic adjustment of control strategies and prediction of system failures.

[0116] Preferably, step S41 includes the following steps:

[0117] Step S411: classifying the control users of the network information access device according to the device control authority, and generating control graded users, wherein the control graded users include the highest level authority user, the middle level authority user and the low level authority user;

[0118] Step S412: Based on the highest-level permission user, the first user device controls the network information access device and generates a first user device control instruction, wherein the first user device control instruction includes a device parameter setting and modification instruction, a device start and stop instruction, and a device configuration query instruction;

[0119] Step S413: Based on the intermediate-level authority user performing second user device control on the network information access device, a second user device control instruction is generated, wherein the second user device control instruction includes a start-stop device instruction and a device configuration query instruction;

[0120] Step S414: performing third user equipment control on the network information access device based on the low-level permission user, generating a third user equipment control instruction, wherein the third user equipment control instruction includes a query device configuration instruction;

[0121] Step S415: performing instruction conflict determination on the first user equipment control instruction, the second user equipment control instruction and the third user equipment control instruction. When an instruction conflict occurs, assigning a high priority to the first user equipment control instruction, assigning a medium priority to the second user equipment control instruction, and assigning a low priority to the third user equipment control instruction, thereby generating a device hierarchical control strategy;

[0122] Step S416: Performing hierarchical control of equipment based on the equipment hierarchical control strategy, and monitoring control data through equipment sensors, thereby obtaining equipment control monitoring data.

[0123] The present invention controls user classification of network information access devices, and the system can realize refined management of the permissions of different users, ensuring that each user can only perform operations within the scope of his or her permissions, thereby improving the security and controllability of the system. Users are classified according to permissions, and the scope of rights and responsibilities of users at each level is clarified, which avoids confusion of permissions and misoperation, and is conducive to improving the stability and reliability of the system. Corresponding device control instructions are generated according to different user permissions, including instructions for setting and modifying device parameters, starting and stopping device instructions, querying device configuration instructions, etc., so that the operation instructions are more standardized and standardized, and the risk of misoperation is reduced. By dividing the priorities and distinguishing conflicts of device control instructions, the reasonable scheduling of the execution order of instructions is realized, the timely execution of high-priority operations is ensured, the system confusion and failure caused by instruction conflicts are avoided, and the stability and reliability of the system are improved. By controlling data monitoring through device sensors, the system can obtain the status information of the device and the user operation behavior in real time, discover abnormal situations in time and respond, which is helpful to improve the response speed and real-time performance of the system.

[0124] In the embodiment of the present invention, the control authority levels of different users are determined, such as the highest-level authority user, the intermediate-level authority user and the low-level authority user. The scope of operations that can be performed at each authority level is defined, including setting and modifying device parameters, starting and stopping devices and querying device configurations. According to the authority definition, users are divided into different levels, and corresponding authorities are assigned to each level. A control hierarchical user list is generated to ensure that each user has a clear authority level and operation authority. The highest-level authority user performs control operations through network information access devices. According to the device control authority, a first user device control instruction is generated, including operation instructions such as setting and modifying device parameters, starting and stopping devices and querying device configurations. The intermediate-level authority user performs control operations through network information access devices. According to the device control authority, a second user device control instruction is generated, including operation instructions such as starting and stopping devices and querying device configurations. The low-level authority user performs control operations through network information access devices. According to the device control authority, a third user device control instruction is generated, mainly including operation instructions such as querying device configurations. Priority judgment is performed on the first user device control instruction, the second user device control instruction and the third user device control instruction. When a command conflict occurs, different execution priorities are assigned to the commands to ensure that high-priority commands can be executed in a timely manner. Generate a device hierarchical control strategy based on the command priority judgment results. Ensure that device control operations are executed according to different user permission levels, thereby improving the security and controllability of the system. Implement device hierarchical control according to the device hierarchical control strategy to ensure that each user can only perform operations for which they have permission. Monitor control data through device sensors to obtain device status and user operation behavior in real time. Record and analyze monitoring data to ensure the effectiveness and compliance of device control.

[0125] In this specification, a security network information intelligent control system based on big data is provided, which is used to execute the above-mentioned security network information intelligent control method based on big data. The security network information intelligent control system based on big data includes:

[0126] The device association module is used to obtain network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition and generate access information feature data; perform device identification based on the access information feature data and generate a network information access device;

[0127] The address detection module is used to perform suspicious address detection on network access address data, generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on suspicious network access addresses, generate abnormal network access address data and perform address imprisonment;

[0128] The control interconnection module is used to obtain access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; use access device environment data to evaluate the control complexity of device control instructions to generate device control complexity data; divide the control authority of device control instructions based on the device control complexity data to generate device control authority;

[0129] The control response module is used to monitor the response control data of the network information access device according to the device control authority and generate the response control monitoring data; perform control delay analysis on the response control monitoring data and generate the response control delay data; optimize the network information control delay based on the response control delay data to perform the intelligent control operation of secure network information based on big data.

[0130] The beneficial effect of the present invention is that by performing feature recognition, anomaly detection and behavior analysis on network access data and addresses, malicious network behaviors can be effectively identified and prevented, and the level of network security can be improved. Device identification and control authority segmentation based on access information feature data can realize personalized management and refined control of devices, and improve device utilization efficiency and safety. The response speed and efficiency of network information control can be improved by evaluating the control complexity and authority segmentation of device control instructions, as well as analyzing and optimizing the delay of response control monitoring data. By collecting and analyzing a large amount of network information data, more accurate and comprehensive data support can be provided to decision makers, and intelligent network information control decisions based on big data can be realized. The execution of the entire process can effectively optimize the network information control delay, improve the performance and stability of the system, and thus provide users with more efficient and reliable network services. Therefore, the present invention improves control efficiency and safety through big data analysis, intelligent control, network security detection, device environment monitoring and control delay optimization.

[0131] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0132] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for intelligent control of security network information based on big data, characterized in that: The following steps are involved: Step S1: Acquire network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition to generate access information feature data; Device identification is performed based on access information feature data to generate network information access device; Step S2: Perform suspicious address detection on the network access address data to generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on the suspicious network access addresses to generate abnormal network access address data and perform address imprisonment; Step S3: Acquire access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; perform control complexity evaluation on device control instructions using access device environment data to generate device control complexity data; perform control authority division on device control instructions based on device control complexity data to generate device control authority; Step S4: monitoring the response control data of the network information access device according to the device control authority to generate response control monitoring data; performing control delay analysis on the response control monitoring data to generate response control delay data; Optimize network information control delay based on response control delay data to perform intelligent control of secure network information based on big data; Step S4 includes the following steps: Step S41: Performing hierarchical control on network information access devices according to device control authority, generating a hierarchical control strategy for devices; performing hierarchical control on devices based on the hierarchical control strategy, and monitoring control data through device sensors, thereby obtaining device control monitoring data; Step S41 includes the following steps: Step S411: classifying the control users of the network information access device according to the device control authority, and generating control graded users, wherein the control graded users include the highest level authority user, the middle level authority user and the low level authority user; Step S412: Based on the highest-level permission user, the first user device controls the network information access device and generates a first user device control instruction, wherein the first user device control instruction includes a device parameter setting and modification instruction, a device start and stop instruction, and a device configuration query instruction; Step S413: Based on the intermediate-level authority user performing second user device control on the network information access device, a second user device control instruction is generated, wherein the second user device control instruction includes a start-stop device instruction and a device configuration query instruction; Step S414: performing third user equipment control on the network information access device based on the low-level permission user, generating a third user equipment control instruction, wherein the third user equipment control instruction includes a query device configuration instruction; Step S415: performing instruction conflict determination on the first user equipment control instruction, the second user equipment control instruction and the third user equipment control instruction. When an instruction conflict occurs, assigning a high priority to the first user equipment control instruction, assigning a medium priority to the second user equipment control instruction, and assigning a low priority to the third user equipment control instruction, thereby generating a device hierarchical control strategy; Step S416: performing hierarchical control of equipment based on the equipment hierarchical control strategy, and monitoring control data through equipment sensors, thereby obtaining equipment control monitoring data; Step S42: transmitting the device control monitoring data to the network information control cloud through the network transmission channel for control response, and generating response control monitoring data; Step S43: performing control delay analysis on the response control monitoring data to generate response control delay data; Step S44: Optimize the network information control delay based on the response control delay data to perform intelligent control operations for secure network information based on big data.

2. The intelligent control method for secure network information based on big data according to claim 1 is characterized in that: Step S1 includes the following steps: Step S11: Acquire network information access data and network access address data; Step S12: performing data cleaning on the network information access data to generate network information access cleaned data; performing data missing value filling on the network information access cleaned data to generate network information access filled data; Step S13: performing data outlier detection on the network information access filling data to generate network information access data outliers; performing logarithmic transformation on the network information access data outliers to generate network information access repair data; Step S14: standardize the network information access repair data to generate standard network information access data; transmit the network information access data to the network information control cloud for user identity matching to generate user identity information data; Step S15: performing access information feature recognition on the network information access data based on the user identity information data to generate access information feature data; performing device identification based on the access information feature data to generate a network information access device.

3. The intelligent control method of security network information based on big data according to claim 2 is characterized in that: Step S15 includes the following steps: Step S151: dividing the access rights of the network information access data based on the user identity information data to generate network access rights data, wherein the access rights division includes read-only rights and operable rights; Step S152: Analyze the access device address characteristics of the network information access data according to the network access permission data to obtain access information characteristic data; Step S153: constructing a network transmission channel for the access information feature data and the network access address data based on the network protocol technology to generate a network transmission channel; performing device matching on the access information feature data using the network transmission channel to generate network information device matching data; Step S154: uniquely identify the network information device matching data, thereby obtaining a network information matching device identification code; perform remote network access to the device through the network information matching device identification code, and generate a network information access device.

4. The intelligent control method for secure network information based on big data according to claim 1 is characterized in that: Step S2 includes the following steps: Step S21: matching the network access address data with the preset access address whitelist by address IP. When the matching result between the network access address data and the preset access address whitelist is true, the corresponding network access address data is marked as a normal network access address; when the matching result between the network access address data and the preset access address whitelist is false, the corresponding network access address data is marked as a suspicious network access address. Step S22: the suspicious network access address data is matched with a preset access address blacklist. When the matching result between the network access address data and the preset access address blacklist is true, the corresponding suspicious network access address is permanently blocked. Step S23: when the matching result between the network access address data and the preset access address blacklist is false, a suspicious address behavior detection is performed on the suspicious network access address to obtain suspicious address behavior data; Step S24: classify the suspicious network access addresses into an address list according to the suspicious address behavior data, and return to step S21 until a normal network access address is obtained, wherein the address list includes a preset access address white list and a preset access address black list.

5. The intelligent control method of security network information based on big data according to claim 4 is characterized in that: Step S23 includes the following steps: Step S231: when the matching result between the network access address data and the preset access address blacklist is false, a historical access address analysis is performed on the suspicious network access address to generate a historical suspicious access address; Step S232: Analyze the access address area range of the historical suspicious access address and the suspicious network access address to generate the historical suspicious network access address area range and the suspicious network access address area range; overlap the address range of the historical suspicious network access address area range and the suspicious network access address area range. When the historical suspicious network access address area range and the suspicious network access address area range overlap, perform IP fraud detection on the suspicious network access address to generate suspicious address fraud detection data; Step S233: When the historical suspicious network access address area range does not overlap with the suspicious network access address area range, a proxy server detection is performed on the suspicious network access address to generate suspicious network access real address data; Step S234: Integrate abnormal behaviors based on the suspicious address fraud detection data and the suspicious network access real address data to obtain suspicious address behavior data.

6. The intelligent control method of security network information based on big data according to claim 1 is characterized in that: Step S3 includes the following steps: Step S31: Obtain access device environment data; Step S32: Based on the normal network access address, the network information access device is interconnected with the cloud to generate a device control instruction; Step S33: Decomposing the device control instruction by using the access device environment data to generate device access control instruction decomposition data, wherein the device access control instruction decomposition data includes instruction type data, control parameters and operation action data; Step S34: evaluating the complexity of command manipulation according to the command type data, control parameters and operation action data, and generating device control complexity data; Step S35: dividing the control authority of the device control instruction based on the device control complexity data to generate device control authority.

7. The intelligent control method of security network information based on big data according to claim 6 is characterized in that: Step S34 includes the following steps: Step S341: performing instruction control type classification based on instruction type data to generate control type classification data; performing device control amplitude calculation on the operation action data using the control type classification data to obtain device control amplitude data; Step S342: performing control parameter quantity analysis on the control parameters according to the device control amplitude data to generate the control parameter quantity; Step S343: planning a control path for the device control amplitude data by controlling the number of parameters, generating device control path data, and synchronously recording the control duration to obtain device control time data; Step S344: perform device control space complexity calculation on the device control path data to obtain the device control space complexity; perform device control time complexity calculation on the device control time data to obtain the device control time complexity; perform instruction complexity evaluation on the device control space complexity and the device control time complexity by using the entropy weight method to generate device control complexity data.

8. A secure network information intelligent control system based on big data, characterized in that: Used to execute the intelligent control method of security network information based on big data as claimed in claim 1, the intelligent control system of security network information based on big data includes: The device association module is used to obtain network information access data and network access address data; transmit the network information access data to the network information control cloud for access information feature recognition and generate access information feature data; perform device identification based on the access information feature data and generate a network information access device; The address detection module is used to perform suspicious address detection on network access address data, generate normal network access addresses and suspicious network access addresses; perform abnormal address behavior analysis on suspicious network access addresses, generate abnormal network access address data and perform address imprisonment; The control interconnection module is used to obtain access device environment data; perform cloud control interconnection on network information access devices based on normal network access addresses to generate device control instructions; use access device environment data to evaluate the control complexity of device control instructions to generate device control complexity data; divide the control authority of device control instructions based on the device control complexity data to generate device control authority; The control response module is used to monitor the response control data of the network information access device according to the device control authority and generate the response control monitoring data; perform control delay analysis on the response control monitoring data and generate the response control delay data; optimize the network information control delay based on the response control delay data to perform the intelligent control operation of secure network information based on big data.

Images