Big data security protection system and method based on trusted computing

Abstract

The present disclosure relates to a big data security protection system and method based on trusted computing. The method includes: using a trusted root deployment module to use a TPCM trusted chip as a trusted root; using an identity recognition module to ensure that only authorized users can access data through identity recognition technology; using a state measurement module to monitor the operating status of the system in real time and identify abnormal behaviors; using a confidentiality storage module to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process. In this way, the system operating status can be monitored through the time sequence behavior pattern of the access traffic, so that abnormal behaviors can be automatically detected and security events can be identified, realizing intelligent security protection of big data and ensuring the security and stability of the system.

Description

Technical Field

[0001] The present disclosure relates to the technical field of big data security protection, and in particular, to a big data security protection system and method based on trusted computing. Background Art

[0002] With the rapid development and widespread application of big data technology, big data security issues have become increasingly prominent. Big data systems face various security threats from both inside and outside, such as data leakage, data tampering, malicious attacks, etc. Therefore, establishing an efficient and reliable big data security protection system has become an important issue in today's information security field.

[0003] However, the encryption measures of traditional big data security protection systems during data storage and transmission may have loopholes, leading to an increased risk of data leakage. In addition, the access control mechanism of traditional systems is usually simple and rough, making it difficult to refine permission control, which can easily lead to unauthorized users accessing sensitive data. In addition, traditional systems have limited capabilities for real-time monitoring and detection of abnormal behavior, often requiring manual intervention and unable to detect security threats in a timely manner.

[0004] Therefore, a big data security protection system based on trusted computing is desired. Summary of the invention

[0005] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0006] In a first aspect, the present disclosure provides a big data security protection system based on trusted computing, the system comprising:

[0007] Trusted root deployment module, used to use the TPCM trusted chip as the trusted root;

[0008] Identity recognition module, used to ensure that only authorized users can access data through identity recognition technology;

[0009] The status measurement module is used to monitor the system's operating status in real time and identify abnormal behavior;

[0010] The confidentiality storage module is used to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process.

[0011] Optionally, the state measurement module includes: an access traffic timing data collection unit, which is used to collect the time series of access traffic through a network sniffer; an access traffic local timing pattern feature extraction unit, which is used to extract the access traffic local timing pattern features from the time series of the access traffic to obtain a sequence of access traffic local timing correlation feature vectors; an access behavior adjacency topology feature extraction unit, which is used to calculate the hash similarity between any two access traffic local timing correlation feature vectors in the sequence of access traffic local timing correlation feature vectors to obtain an access behavior adjacency topology feature matrix; an access traffic local timing correlation encoding unit under topological correlation, Used to perform graph-structure-based semantic association encoding on the sequence of local time-series association feature vectors of the access traffic and the adjacency topological feature matrix between the access behaviors to obtain a sequence of local time-series association feature vectors of the access traffic under topological association; an access traffic full-time domain behavior pattern semantic representation unit, used to pass the sequence of local time-series association feature vectors of the access traffic under topological association through a feature sequence fusion based on prior distribution to obtain an access traffic behavior pattern representation semantic feature vector as an access traffic behavior pattern representation semantic feature; an operation status anomaly detection unit, used to determine whether there is an anomaly in the operation status of the system based on the access traffic behavior pattern representation semantic feature.

[0012] Optionally, the access traffic local time series pattern feature extraction unit includes: an access traffic time series data segmentation subunit, used to segment the time series of the access traffic based on a predetermined time scale to obtain a sequence of local time series of the access traffic; an access traffic local time series data regularization subunit, used to regularize the local time series of each access traffic in the sequence of local time series of the access traffic according to the time dimension to obtain a sequence of local time series input vectors of the access traffic; an access traffic local time series feature capture subunit, used to pass each access traffic local time series input vector in the sequence of local time series input vectors of the access traffic through an access traffic time series pattern feature extractor based on a one-dimensional convolutional layer to obtain a sequence of local time series associated feature vectors of the access traffic.

[0013] Optionally, the local timing association encoding unit for access traffic under the topological association is used to: pass the sequence of local timing association feature vectors of the access traffic and the adjacency topological feature matrix between the access behaviors through a graph neural network model to obtain the sequence of local timing association feature vectors of the access traffic under the topological association.

[0014] Optionally, the access traffic full-time domain behavior pattern semantic representation unit includes: a prior vector calculation subunit, used to calculate the prior vectors of the access traffic local timing association feature vectors under the topological association in the sequence of the access traffic local timing association feature vectors under the topological association to obtain a sequence of prior vectors; a traffic behavior pattern representation subunit, used to calculate the positional sum of each prior vector in the sequence of prior vectors to obtain the access traffic behavior pattern representation semantic feature vector.

[0015] Optionally, the prior vector calculation subunit is further used to: multiply each local timing association feature vector of access traffic under topology association in the sequence of local timing association feature vectors of access traffic under topology association by a predetermined weight hyperparameter to obtain a sequence of local timing association feature vectors of access traffic under modulation topology association; calculate an exponential function value raised to the power of the eigenvalue of each position of the local timing association feature vector of access traffic under modulation topology association in the sequence of local timing association feature vectors of access traffic under modulation topology association to obtain a sequence of exponential local timing association feature vectors of access traffic under modulation topology association; multiply each local timing association feature vector of access traffic under exponential modulation topology association in the sequence of local timing association feature vectors of access traffic under exponential modulation topology association by a Gaussian distribution random number function value to obtain the sequence of the prior vectors, wherein all of the Gaussian distribution random number function values ​​are generated by a Gaussian distribution random number function with a mean of 0 and a variance of 1.

[0016] Optionally, the operation status abnormality detection unit is used to: pass the access traffic behavior pattern characterization semantic feature vector through a classifier-based operation status identifier to obtain a recognition result, and the recognition result is used to indicate whether there is an abnormality in the operation status of the system.

[0017] Optionally, it also includes a training module for training the access traffic timing pattern feature extractor based on the one-dimensional convolutional layer, the graph neural network model, the feature sequence aggregator based on the prior distribution and the classifier-based operation status identifier.

[0018] Optionally, the training module includes: a training access traffic timing data collection unit, which is used to collect the time series of training access traffic through the network sniffer; a training access traffic local timing pattern feature extraction unit, which is used to extract the access traffic local timing pattern features of the time series of the training access traffic to obtain a sequence of training access traffic local timing association feature vectors; a training access behavior adjacency topology feature extraction unit, which is used to calculate the hash similarity between any two training access traffic local timing association feature vectors in the sequence of training access traffic local timing association feature vectors to obtain an adjacency topology feature matrix between training access behaviors; a training topology association access traffic local timing association encoding unit, which is used to perform graph-based semantic association encoding on the sequence of training access traffic local timing association feature vectors and the training access behavior adjacency topology feature matrix to obtain a sequence of training topology association access traffic local timing association feature vectors; a training access traffic full-time domain behavior pattern semantic representation unit, which is used to encode the training access traffic local timing association under the training topology association The sequence of feature vectors is passed through the feature sequence fusion device based on prior distribution to obtain the training access traffic behavior pattern characterization semantic feature vector; the training operation status anomaly detection unit is used to pass the training access traffic behavior pattern characterization semantic feature vector through the classifier-based operation status identifier to obtain the classification loss function value; the training loss function calculation unit is used to calculate the cross entropy loss function value between the access traffic behavior pattern characterization semantic feature vector and the training access traffic behavior pattern characterization semantic feature vector; the training unit is used to train the access traffic time series pattern feature extractor based on the one-dimensional convolution layer, the graph neural network model, the feature sequence fusion device based on prior distribution and the classifier-based operation status identifier based on the weighted sum of the classification loss function value and the cross entropy loss function value, and in each iterative training, when back-propagating through the training access traffic behavior pattern characterization semantic feature vector based on the classification loss function value and the cross entropy loss function value, the training access traffic behavior pattern characterization semantic feature vector is optimized.

[0019] In a second aspect, the present disclosure provides a big data security protection method based on trusted computing, the method comprising:

[0020] Use the trusted root deployment module to use the TPCM trusted chip as the trusted root;

[0021] Use the identity recognition module to ensure that only authorized users can access data through identity recognition technology;

[0022] Use the status measurement module to monitor the system's operating status in real time and identify abnormal behavior;

[0023] Use the confidentiality storage module to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process.

[0024] The above technical solution is adopted, and the TPCM trusted chip is used as the trusted root by using the trusted root deployment module; the identity recognition module is used to ensure that only authorized users can access the data through identity recognition technology; the state measurement module is used to monitor the operating status of the system in real time and identify abnormal behaviors; the confidential storage module is used to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process. In this way, the system operating status can be monitored through the time sequence behavior pattern of the access traffic, so that abnormal behaviors can be automatically detected and security events can be identified, and intelligent security protection of big data can be realized to ensure the security and stability of the system.

[0025] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0027] Figure 1 It is a block diagram of a big data security protection system based on trusted computing according to an exemplary embodiment.

[0028] Figure 2 It is a block diagram of the state measurement module of a big data security protection system based on trusted computing according to an exemplary embodiment.

[0029] Figure 3 The present invention is a flowchart of a big data security protection method based on trusted computing according to an exemplary embodiment.

[0030] Figure 4 It is a block diagram of an electronic device according to an exemplary embodiment.

[0031] Figure 5 It is an application scenario diagram of a big data security protection system based on trusted computing according to an exemplary embodiment. DETAILED DESCRIPTION

[0032] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0033] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0034] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0035] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0036] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0037] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0038] In order to solve the above problems, the present disclosure provides a big data security protection system and method based on trusted computing, which uses the trusted root deployment module to use the TPCM trusted chip as the trusted root; uses the identity recognition module to ensure that only authorized users can access the data through identity recognition technology; uses the state measurement module to monitor the operating status of the system in real time and identify abnormal behaviors; uses the confidentiality storage module to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process. In this way, the system operating status can be monitored by accessing the time sequence behavior pattern of the traffic, so that abnormal behaviors can be automatically detected and security events can be identified, realizing intelligent security protection of big data and ensuring the security and stability of the system.

[0039] The specific embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0040] The big data security protection system based on trusted computing is a comprehensive solution that integrates trusted computing technology to protect the security of the big data environment. The design of this system aims to ensure the safety and reliability of big data collection, storage, processing and transmission through a series of security mechanisms. Trusted computing is a technical means to ensure the security and credibility of the system through the combination of hardware and software, including the use of trusted execution environment, encryption technology, identity authentication and other methods to protect the system from malicious attacks and data leakage threats.

[0041] Figure 1 FIG. 1 is a block diagram of a big data security protection system based on trusted computing according to an exemplary embodiment. Figure 1 As shown, the system 100 includes:

[0042] A trusted root deployment module 101 is used to use the TPCM trusted chip as a trusted root;

[0043] An identity recognition module 102, used to ensure that only authorized users can access data through identity recognition technology;

[0044] The state measurement module 103 is used to monitor the operating state of the system in real time and identify abnormal behavior;

[0045] The confidentiality storage module 104 is used to ensure that the stored data is encrypted to prevent the data from being accessed or tampered with by unauthorized persons during the storage process.

[0046] Accordingly, in the above-mentioned big data security protection system based on trusted computing, real-time monitoring of the system's operating status can help timely discover abnormal behaviors and security threats in the system, including unauthorized access, malicious attacks, data leakage, etc., so that corresponding countermeasures can be taken in time to prevent security incidents from further expanding and causing serious consequences. Therefore, it is crucial to monitor the system's operating status in real time and identify abnormal behaviors.

[0047] In particular, in the process of monitoring the system operation status, it is possible to monitor and analyze the user access behavior in the system by collecting access flow data, so as to detect abnormal behaviors in time, such as unauthorized access, abnormal data transmission, etc., and help discover potential security threats. At the same time, access flow data can help the system identify security incidents, such as malicious attacks, data leakage, malware propagation, etc. By analyzing the access flow, abnormal patterns and behaviors can be discovered, and corresponding security measures can be taken in time.

[0048] Based on this, in the process of monitoring the system operation status, the technical concept of this application is to collect access traffic data through real-time monitoring through a network sniffer, and introduce data processing and analysis algorithms at the back end to analyze and capture the time-series correlation characteristics of the access traffic data, so as to characterize the full-time domain behavior pattern of the access traffic, and thus determine whether there is an abnormality in the system's operation status. In this way, the system operation status can be monitored through the time-series behavior pattern of the access traffic, so that abnormal behavior can be automatically detected and security incidents can be identified, realizing intelligent security protection of big data and ensuring the security and stability of the system.

[0049] Figure 2 FIG. 1 is a block diagram of a state measurement module of a big data security protection system based on trusted computing according to an exemplary embodiment. Figure 2 As shown, the state measurement module 103 includes: an access traffic timing data collection unit 1031, which is used to collect the time series of access traffic through a network sniffer; an access traffic local timing pattern feature extraction unit 1032, which is used to extract the access traffic local timing pattern features from the time series of the access traffic to obtain a sequence of access traffic local timing correlation feature vectors; an access behavior adjacency topology feature extraction unit 1033, which is used to calculate the hash similarity between any two access traffic local timing correlation feature vectors in the sequence of access traffic local timing correlation feature vectors to obtain an access behavior adjacency topology feature matrix; an access traffic local timing correlation encoding unit under topological correlation 1034, used for performing graph-structure-based semantic association encoding on the sequence of the local time series association feature vectors of the access traffic and the adjacency topological feature matrix between the access behaviors to obtain a sequence of the local time series association feature vectors of the access traffic under topological association; an access traffic full-time domain behavior pattern semantic representation unit 1035, used for passing the sequence of the local time series association feature vectors of the access traffic under topological association through a feature sequence fusion based on prior distribution to obtain an access traffic behavior pattern representation semantic feature vector as an access traffic behavior pattern representation semantic feature; an operation status anomaly detection unit 1036, used for determining whether there is an anomaly in the operation status of the system based on the access traffic behavior pattern representation semantic feature.

[0050] Specifically, in the state measurement module, first, the time series of the access traffic is collected by the network sniffer. Next, considering that the amount of information in the time series data of the access traffic is large, and the access traffic may present different local time series change patterns and trends in different local time periods, this will affect the accuracy of the semantic representation of the access traffic behavior pattern, thereby affecting the ability to detect abnormalities in the system operation status. Based on this, in the technical solution of the present application, it is necessary to segment the time series of the access traffic based on a predetermined time scale to obtain a sequence of local time series of the access traffic. By segmenting the time series of the access traffic according to a predetermined time scale, the entire time series of the access traffic can be decomposed into multiple local time series. The advantage of doing this is that the local time series patterns and changes of the access traffic can be better captured, thereby helping to more comprehensively and accurately analyze and understand the time series characteristics of the access traffic data.

[0051] In one embodiment of the present disclosure, the access traffic local time series pattern feature extraction unit includes: an access traffic time series data segmentation subunit, used to segment the time series of the access traffic based on a predetermined time scale to obtain a sequence of local time series of the access traffic; an access traffic local time series data regularization subunit, used to regularize the local time series of each access traffic in the sequence of local time series of the access traffic according to the time dimension to obtain a sequence of local time series input vectors of the access traffic; an access traffic local time series feature capture subunit, used to pass each access traffic local time series input vector in the sequence of local time series input vectors through an access traffic time series pattern feature extractor based on a one-dimensional convolutional layer to obtain a sequence of local time series associated feature vectors of the access traffic.

[0052] Next, considering that the access traffic will change over time, in order to better represent the time series characteristics and patterns of the access traffic data, so as to more accurately identify the abnormal state of the system, in the technical solution of the present application, it is necessary to regularize the local time series of each access traffic in the sequence of the local time series of the access traffic according to the time dimension to obtain a sequence of local time series input vectors of the access traffic. Then, each local time series input vector of the access traffic in the sequence of local time series input vectors of the access traffic is subjected to feature mining in an access traffic time series pattern feature extractor based on a one-dimensional convolutional layer, so as to extract the local time series feature information of the access traffic in each local time period, thereby obtaining a sequence of local time series correlation feature vectors of the access traffic, which contains the local time series pattern and change trend characteristics of the access traffic, thereby providing a more powerful feature representation for subsequent data analysis and modeling.

[0053] Furthermore, since each access traffic local time series correlation feature vector in the sequence of the access traffic local time series correlation feature vector respectively represents the local time series feature of the access traffic in each local time period, it is used to reflect the local time series pattern and change trend of the access traffic. In addition, it is also considered that in the actual system operation status detection process, if the system operation status is normal, the similarity between the local time series behavior patterns of the access traffic is high. If an abnormal situation occurs, the local time series feature of the access traffic that is different from the overall time series behavior pattern will appear. Based on this, in the technical solution of the present application, the hash similarity between any two access traffic local time series correlation feature vectors in the sequence of the access traffic local time series correlation feature vector is further calculated to obtain the adjacency topology feature matrix between the access behaviors. It should be understood that hash similarity is a method for measuring data similarity. By calculating the hash similarity between any two access traffic local time series correlation feature vectors, the similarity of the local time series behavior pattern of the access traffic in each local time period can be measured, thereby helping to discover common access behavior patterns, so as to facilitate further detection of abnormal operation status.

[0054] Furthermore, each access traffic local timing correlation feature vector in the sequence of the access traffic local timing correlation feature vector is used as the feature representation of the node, and the access behavior adjacency topology feature matrix is ​​used as the feature representation of the edge between nodes, and the access traffic timing correlation feature matrix obtained by two-dimensionally arranging the multiple access traffic local timing correlation feature vectors and the access behavior adjacency topology feature matrix are passed through a graph neural network model to obtain a sequence of access traffic local timing correlation feature vectors under topological association. Specifically, the graph neural network model performs graph structure data encoding on the access traffic timing correlation feature matrix and the access behavior adjacency topology feature matrix through learnable neural network parameters to obtain a sequence of access traffic local timing correlation feature vectors under topological association that contains irregular adjacency topology correlation features and each access traffic local timing correlation feature information.

[0055] In one embodiment of the present disclosure, the local timing association encoding unit for access traffic under topological association is used to: pass the sequence of local timing association feature vectors of the access traffic and the adjacency topological feature matrix between the access behaviors through a graph neural network model to obtain the sequence of local timing association feature vectors of the access traffic under topological association.

[0056] Then, it is considered that each local time series correlation feature vector of the access traffic under the topological association in the sequence of the local time series correlation feature vector of the access traffic under the topological association respectively reflects each local time series correlation feature of the access traffic containing the topological correlation feature information of the similarity of the irregular local time series pattern of the access traffic. Moreover, the local time series correlation patterns of these access traffics have time series correlation semantics and mutual influence. Therefore, in order to be able to integrate these local time series features of the access traffic in each local time period, so as to perform a comprehensive semantic representation of the full time domain behavior of the access traffic, in the technical solution of the present application, the sequence of the local time series correlation feature vector of the access traffic under the topological association is further passed through a feature sequence fusion device based on a prior distribution to obtain a semantic feature vector representing the behavior pattern of the access traffic. By using the feature sequence fusion device based on a prior distribution, each local time series feature of the access traffic containing the topological correlation feature information of the similarity of the local time series pattern of the access traffic can be used as a prior knowledge to guide the feature fusion process. In this way, it is possible to screen and highlight features based on the autocorrelation semantics of the local temporal behavior pattern features of each access traffic in the prior knowledge, thereby extracting more semantic and interpretable access traffic behavior pattern representation features and obtaining more accurate and interpretable feature representations.

[0057] In one embodiment of the present disclosure, the access traffic full-time domain behavior pattern semantic representation unit includes: a prior vector calculation subunit, used to calculate the prior vectors of the access traffic local timing association feature vectors under the topological association in the sequence of the access traffic local timing association feature vectors under the topological association to obtain a sequence of prior vectors; a traffic behavior pattern representation subunit, used to calculate the positional sum of each prior vector in the sequence of prior vectors to obtain the access traffic behavior pattern representation semantic feature vector.

[0058] Furthermore, the prior vector calculation subunit is further used to: multiply each local timing association feature vector of access traffic under topology association in the sequence of local timing association feature vectors of access traffic under topology association by a predetermined weight hyperparameter to obtain a sequence of local timing association feature vectors of access traffic under modulation topology association; calculate an exponential function value with the eigenvalue of each position of the local timing association feature vector of access traffic under modulation topology association in the sequence of local timing association feature vectors of access traffic under modulation topology association as the power to obtain a sequence of local timing association feature vectors of access traffic under exponential modulation topology association; multiply each local timing association feature vector of access traffic under exponential modulation topology association in the sequence of local timing association feature vectors of access traffic under exponential modulation topology association by a Gaussian distribution random number function value to obtain the sequence of the prior vectors, wherein all of the Gaussian distribution random number function values ​​are generated by a Gaussian distribution random number function with a mean of 0 and a variance of 1.

[0059] In particular, in a specific example of the present application, the sequence of the local temporal correlation feature vectors of the access traffic under the topological association is processed by the feature sequence fusion device based on the prior distribution with the following fusion formula to obtain the semantic feature vector representing the access traffic behavior pattern;

[0060] Among them, the fusion formula is:

[0061]

[0062] Wherein, V1 is the first local time series correlation feature vector of the access traffic under topological association in the sequence of local time series correlation feature vectors of the access traffic under topological association, V2 is the second local time series correlation feature vector of the access traffic under topological association in the sequence of local time series correlation feature vectors of the access traffic under topological association, V n The nth topologically associated access traffic local time series association feature vector in the sequence of the topologically associated access traffic local time series association feature vector, p1, p2 and p n are weight hyperparameters, f1, f2, and f n The hyperparameters of the Gaussian distribution function coefficients are generated by a Gaussian distribution random number function with a mean of 0 and a variance of 1. is vector addition, V c A semantic feature vector is generated to characterize the access traffic behavior pattern.

[0063] Then, the semantic feature vector representing the access traffic behavior pattern is passed through a classifier-based operation status identifier to obtain an identification result, which is used to indicate whether the operation status of the system is abnormal. In other words, the semantic features representing the full-time domain behavior pattern of the access traffic are used for classification processing to determine whether the operation status of the system is abnormal. In this way, the system operation status can be monitored through the time-series behavior pattern of the access traffic, so that abnormal behavior can be automatically detected and security events can be identified, realizing intelligent security protection of big data and ensuring the security and stability of the system.

[0064] In one embodiment of the present disclosure, the operation status abnormality detection unit is used to: pass the access traffic behavior pattern characterization semantic feature vector through a classifier-based operation status identifier to obtain an identification result, and the identification result is used to indicate whether there is an abnormality in the operation status of the system.

[0065] Furthermore, in one embodiment of the present disclosure, the big data security protection system based on trusted computing also includes a training module for training the access traffic timing pattern feature extractor based on the one-dimensional convolutional layer, the graph neural network model, the feature sequence aggregator based on prior distribution, and the classifier-based operation status identifier. The training module includes: a training access traffic time series data collection unit, which is used to collect the time series of training access traffic through the network sniffer; a training access traffic local time series pattern feature extraction unit, which is used to extract the access traffic local time series pattern features from the time series of the training access traffic to obtain a sequence of training access traffic local time series correlation feature vectors; a training access behavior adjacency topology feature extraction unit, which is used to calculate the hash similarity between any two training access traffic local time series correlation feature vectors in the sequence of training access traffic local time series correlation feature vectors to obtain a training access behavior adjacency topology feature matrix; a training topology correlation access traffic local time series correlation encoding unit, which is used to perform graph-based semantic correlation encoding on the sequence of training access traffic local time series correlation feature vectors and the training access behavior adjacency topology feature matrix to obtain a sequence of training topology correlation access traffic local time series correlation feature vectors; a training access traffic full-time domain behavior pattern semantic representation unit, which is used to convert the training access traffic local time series correlation feature vectors under the training topology correlation into a semantic representation of the training access traffic local time series correlation feature vectors; The sequence of vectors is passed through the feature sequence fusion device based on prior distribution to obtain the training access traffic behavior pattern characterization semantic feature vector; the training operation status anomaly detection unit is used to pass the training access traffic behavior pattern characterization semantic feature vector through the classifier-based operation status identifier to obtain the classification loss function value; the training loss function calculation unit is used to calculate the cross entropy loss function value between the access traffic behavior pattern characterization semantic feature vector and the training access traffic behavior pattern characterization semantic feature vector; the training unit is used to train the access traffic time series pattern feature extractor based on the one-dimensional convolution layer, the graph neural network model, the feature sequence fusion device based on prior distribution and the classifier-based operation status identifier based on the weighted sum of the classification loss function value and the cross entropy loss function value, and in each iterative training, when back propagating through the training access traffic behavior pattern characterization semantic feature vector based on the classification loss function value and the cross entropy loss function value, the training access traffic behavior pattern characterization semantic feature vector is optimized.

[0066] In the technical solution of the present application, the sequence of local timing correlation feature vectors of the training access traffic represents the local neighborhood timing correlation features of the training access traffic in the local time domain window determined by sequence segmentation, and the adjacency topological feature matrix between the training access behaviors represents the topological correlation between the timing correlation features of the access traffic in different local time domain windows. Therefore, after passing the sequence of local timing correlation feature vectors of the training access traffic and the adjacency topological feature matrix between the training access behaviors through a graph neural network model, each local timing correlation feature vector of the access traffic under the training topological correlation in the obtained sequence of local timing correlation feature vectors of the access traffic under the training topological correlation further represents the local neighborhood timing correlation features of the local timing distribution of each training access traffic based on the topological correlation between the timing correlation features of the access traffic under different local time domain windows, that is, each local timing correlation feature vector of the access traffic under the training topological correlation in the sequence of local timing correlation feature vectors of the access traffic under the training topological correlation has different timing feature representation modes based on the timing dimension and the spatial dimension. Correspondingly, after the sequence of local temporal correlation feature vectors of access traffic under the training topology association passes through the feature sequence fusion device based on prior distribution, the obtained semantic feature vector representing the behavior pattern of the training access traffic has a complex semantic feature representation dimension with a multi-dimensional distribution of different temporal characteristics based on temporal dimension and spatial dimension. Therefore, it is expected to improve the feature expression effect under the complex semantic representation dimension during the model iteration process.

[0067] Based on this, the applicant of the present application further introduces a cross entropy loss function between the real access traffic behavior pattern representation semantic feature vector and the inferred training access traffic behavior pattern representation semantic feature vector in addition to the classification loss function value during each iteration of the model, and optimizes the training access traffic behavior pattern representation semantic feature vector V when back propagating through the training access traffic behavior pattern representation semantic feature vector based on the cross entropy loss function, which is expressed as: In each iteration of training, the training access traffic behavior pattern representation semantic feature vector is optimized based on the classification loss function value and the cross entropy loss function value when back propagating through the training access traffic behavior pattern representation semantic feature vector to obtain the optimized training access traffic behavior pattern representation semantic feature vector; wherein the optimization formula is:

[0068]

[0069] Among them, μ, σ and v max They are the feature sets v i ∈V, log is the logarithmic function with base 2, and α is the weight hyperparameter, v max-1 is the feature set v i ∈V, V is the semantic feature vector representing the training access traffic behavior pattern, V' is the semantic feature vector representing the optimized training access traffic behavior pattern, represents positional addition, represents positional subtraction, and ⊙ represents positional multiplication.

[0070] Here, we use an interactive representation containing probability statistics features represented by mean μ and standard value σ and v as a latent variable feature. i and v max The short sequence of distributed interactive representation is used as the sub-manifold latent motif under the complex manifold network of the training access traffic behavior pattern representation semantic feature vector V, and the latent motif feature information pattern and feature distribution pattern of the training access traffic behavior pattern representation semantic feature vector V are obtained as its global structure inference unit, so as to reconstruct the complex manifold structure of the training access traffic behavior pattern representation semantic feature vector V in the form of a global structure latent motif dictionary based on connection, so as to improve the model's ability to generate and evolve the manifold structure corresponding to the associated features of the complex semantic feature association representation dimension during the iteration process, and improve the feature expression effect of the complex semantic feature representation dimension of the multi-dimensional distribution of different time series features based on the time series dimension and the space dimension during the model iteration process. In this way, it is possible to more accurately judge whether there is an abnormality in the operating status of the system based on the semantics of the full-time domain behavior pattern representation of the access traffic, thereby realizing intelligent security protection of big data and ensuring the security and stability of the system.

[0071] In summary, the above solution is adopted to collect access traffic data through real-time monitoring through a network sniffer, and introduce data processing and analysis algorithms at the back end to analyze and capture the time-series correlation characteristics of the access traffic data, so as to characterize the full-time domain behavior pattern of the access traffic, and thus determine whether there is an abnormality in the operation status of the system. In this way, the system operation status can be monitored through the time-series behavior pattern of the access traffic, so that abnormal behavior can be automatically detected and security events can be identified, realizing intelligent security protection of big data and ensuring the security and stability of the system.

[0072] Figure 3 is a flow chart of a big data security protection method based on trusted computing according to an exemplary embodiment. Figure 3 As shown, the method includes:

[0073] Step 201: Use the trusted root deployment module to use the TPCM trusted chip as the trusted root;

[0074] Step 202: Use the identity recognition module to ensure that only authorized users can access the data through identity recognition technology;

[0075] Step 203: Use the status measurement module to monitor the operating status of the system in real time and identify abnormal behavior;

[0076] Step 204: Use a confidentiality storage module to ensure that the stored data is encrypted to prevent unauthorized access or tampering of the data during storage.

[0077] Reference below Figure 4 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0078] like Figure 4 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0079] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0080] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0081] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0082] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0083] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0084] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0085] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0086] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, a test parameter acquisition module may also be described as a "module for acquiring device test parameters corresponding to a target device".

[0087] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0088] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] Figure 5 FIG. 1 is an application scenario diagram of a big data security protection system based on trusted computing according to an exemplary embodiment. Figure 5 As shown, in this application scenario, first, the time series of access traffic collected by the network sniffer (for example, Figure 5 Then, the time series of the access traffic is input into a server (for example, Figure 5 In S) shown in , the server is able to process the time series of the access traffic based on the big data security protection algorithm of trusted computing to determine whether there is any abnormality in the operating status of the system.

[0090] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0091] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0092] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A big data security protection system based on trusted computing, characterized in that: include: Trusted root deployment module, used to use the TPCM trusted chip as the trusted root; Identity recognition module, used to ensure that only authorized users can access data through identity recognition technology; The status measurement module is used to monitor the system's operating status in real time and identify abnormal behavior; A confidentiality storage module is used to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process; The state measurement module comprises: An access traffic time series data collection unit, used for collecting the time series of access traffic through a network sniffer; An access traffic local time series pattern feature extraction unit, used to extract access traffic local time series pattern features from the time series of the access traffic to obtain a sequence of access traffic local time series associated feature vectors; An access behavior adjacency topology feature extraction unit, used for calculating the hash similarity between any two access traffic local time series correlation feature vectors in the sequence of the access traffic local time series correlation feature vectors to obtain an access behavior adjacency topology feature matrix; A local temporal correlation coding unit for access traffic under topological correlation, used for performing semantic correlation coding based on a graph structure on the sequence of local temporal correlation feature vectors of access traffic and the adjacency topological feature matrix between access behaviors to obtain a sequence of local temporal correlation feature vectors of access traffic under topological correlation; The access traffic full-time domain behavior pattern semantic representation unit is used to pass the sequence of the access traffic local time series association feature vector under the topological association through a feature sequence fusion device based on prior distribution to obtain the access traffic behavior pattern representation semantic feature vector as the access traffic behavior pattern representation semantic feature; An operation status anomaly detection unit, used to determine whether the operation status of the system is abnormal based on the semantic features of the access traffic behavior pattern representation; The access traffic local time series pattern feature extraction unit includes: The access traffic time series data segmentation subunit is used to segment the time series of the access traffic based on a predetermined time scale to obtain a sequence of local time series of the access traffic; An access traffic local time series data regularization subunit, used for performing data regularization on each local time series of access traffic in the sequence of local time series of access traffic according to the time dimension to obtain a sequence of local time series input vectors of access traffic; An access traffic local time series feature capturing subunit, used for respectively passing each access traffic local time series input vector in the sequence of the access traffic local time series input vector through an access traffic time series pattern feature extractor based on a one-dimensional convolutional layer to obtain a sequence of the access traffic local time series associated feature vectors; The local temporal correlation encoding unit for access traffic under topological association is used to: obtain the sequence of local temporal correlation feature vectors of access traffic under topological association by passing the sequence of local temporal correlation feature vectors of access traffic and the adjacency topological feature matrix between access behaviors through a graph neural network model; The access traffic full-time domain behavior pattern semantic representation unit includes: A priori vector calculation subunit, used to calculate the priori vector of each local time series correlation feature vector of the access traffic under topological association in the sequence of the local time series correlation feature vector of the access traffic under topological association to obtain a sequence of priori vectors; A traffic behavior pattern characterization subunit, used for calculating the positional sum of each priori vector in the sequence of the priori vectors to obtain the access traffic behavior pattern characterization semantic feature vector; The prior vector calculation subunit is further used for: Multiplying each local time series correlation feature vector of access traffic under topological association in the sequence of local time series correlation feature vectors of access traffic under topological association by a predetermined weight hyperparameter to obtain a sequence of local time series correlation feature vectors of access traffic under modulated topological association; Calculate the exponential function value of the eigenvalue of each position of the local timing association characteristic vector of the access traffic under the modulation topology association in the sequence of the local timing association characteristic vector of the access traffic under the modulation topology association to obtain the sequence of the local timing association characteristic vector of the access traffic under the exponential modulation topology association; Each local timing correlation feature vector of access traffic under the exponential modulation topology association in the sequence of local timing correlation feature vectors of access traffic under the exponential modulation topology association is multiplied by a Gaussian distribution random number function value to obtain the sequence of the prior vectors, wherein all the Gaussian distribution random number function values ​​are generated by a Gaussian distribution random number function with a mean of 0 and a variance of 1.

2. The big data security protection system based on trusted computing according to claim 1 is characterized in that: The operation status abnormality detection unit is used to: pass the access traffic behavior pattern characterization semantic feature vector through a classifier-based operation status identifier to obtain a recognition result, and the recognition result is used to indicate whether there is an abnormality in the operation status of the system.

3. The big data security protection system based on trusted computing according to claim 2 is characterized in that: It also includes a training module for training the access traffic timing pattern feature extractor based on the one-dimensional convolutional layer, the graph neural network model, the feature sequence aggregator based on the prior distribution, and the classifier-based operating status identifier.

4. The big data security protection system based on trusted computing according to claim 3 is characterized in that: The training module comprises: A training access traffic time series data collection unit, used to collect the time series of the training access traffic through the network sniffer; A training access traffic local time series pattern feature extraction unit, used to extract access traffic local time series pattern features from the time series of the training access traffic to obtain a sequence of training access traffic local time series associated feature vectors; The adjacency topology feature extraction unit between training access behaviors is used to calculate the hash similarity between any two local time series correlation feature vectors of training access traffic in the sequence of local time series correlation feature vectors of training access traffic to obtain the adjacency topology feature matrix between training access behaviors; A local temporal correlation coding unit for access traffic under training topological correlation is used to perform semantic correlation coding based on a graph structure on the sequence of local temporal correlation feature vectors of the training access traffic and the adjacency topological feature matrix between the training access behaviors to obtain a sequence of local temporal correlation feature vectors of access traffic under training topological correlation; A semantic characterization unit for training access traffic full-time domain behavior pattern, used for passing the sequence of local time series association feature vectors of access traffic under the training topology association through the feature sequence fuser based on prior distribution to obtain a semantic feature vector for characterizing the training access traffic behavior pattern; A training operation state abnormality detection unit, used for passing the semantic feature vector representing the training access traffic behavior pattern through the classifier-based operation state identifier to obtain a classification loss function value; A training loss function calculation unit, used to calculate the cross entropy loss function value between the access traffic behavior pattern representation semantic feature vector and the training access traffic behavior pattern representation semantic feature vector; A training unit is used to train the access traffic timing pattern feature extractor based on the one-dimensional convolution layer, the graph neural network model, the feature sequence fusion device based on the prior distribution and the classifier-based operation status identifier based on the weighted sum of the classification loss function value and the cross entropy loss function value. In each iterative training, the training access traffic behavior pattern representation semantic feature vector is optimized when back propagation is performed through the training access traffic behavior pattern representation semantic feature vector based on the classification loss function value and the cross entropy loss function value.

5. A big data security protection method based on trusted computing, performed by a big data security protection system based on trusted computing as claimed in any one of claims 1 to 4, characterized in that: include: Use the trusted root deployment module to use the TPCM trusted chip as the trusted root; Use the identity recognition module to ensure that only authorized users can access data through identity recognition technology; Use the status measurement module to monitor the system's operating status in real time and identify abnormal behavior; Use the confidentiality storage module to ensure that the stored data is encrypted to prevent unauthorized access or tampering during the storage process.

Images