A network information security management method and system based on big data

Abstract

The invention relates to the field of network information management, and in particular to a network information security management method and system based on big data. Functional areas are established through the browsing records of employees in enterprise positions, so that web pages that have not been visited by the employees in a certain period of time but are related to their work can be identified, and then by comparing whether the request information of the employees in the position is located in the web page corresponding to the functional area, the first step of judging whether the employee's behavior is an intrusion behavior is achieved. Subsequently, for the web page corresponding to the request information that is not in the functional area, the total similarity between it and the browsing record set is calculated, and the second step of judging is performed, and the request behavior corresponding to the request information with a total similarity less than a security threshold is regarded as a dangerous behavior, thereby protecting the network information security of the enterprise intranet. The invention solves the problem that it is difficult to detect the intrusion behavior when the intranet user invades the intranet system based on the method of detecting its behavior based on the flow threshold.

Description

Technical Field

[0001] The present invention relates to the field of network information management, and in particular to a network information security management method and system based on big data. Background Art

[0002] Security protection of the network information of an enterprise's intranet system generally requires two perspectives. One is that external intruders obtain the identity credentials of the enterprise's intranet and lurk inside the enterprise to steal information. In this case, it is generally identified by detecting abnormal traffic in the intranet system. Another is that internal employees of the enterprise use their own accounts to intrude on the intranet. Since the user is more familiar with the internal network structure of the enterprise, he can accurately reach the designated website to access confidential information. Therefore, the traffic generated is relatively smaller. Therefore, it is often difficult to accurately judge by traffic thresholds. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a network information security management method and system based on big data, which solves the problem that when intranet users invade the intranet system, their behavior is detected based on traffic thresholds, which makes it difficult to detect intrusion behavior.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] A network information security management method based on big data comprises the following steps:

[0006] S1. Obtain enterprise big data of enterprise users logging into the enterprise website, wherein the enterprise big data includes web page addresses, website topology and website content of employees in different positions of the enterprise logging into the enterprise website, and classify the enterprise big data according to the employee positions;

[0007] S2. Calculate the central node of the website topology area corresponding to the web browsing records of employees in the same position based on the enterprise big data, and determine several nodes with the shortest distance as the functional area based on the distance between the central node and each node in the web browsing records;

[0008] S3, obtaining the first node position of the web page corresponding to the user request information in the website topology map, and determining whether the first node position is located in the functional area;

[0009] If so, then end;

[0010] If not, proceed to step S4;

[0011] S4, calculating the total similarity between the webpage text in the functional area and the webpage text content corresponding to the request information;

[0012] S5. Set a security threshold, and determine whether the information requested by the enterprise employee is a risky behavior based on whether the total similarity is less than the security threshold;

[0013] If yes, the employee's request behavior is blocked, and the employee's IP address and hardware address are output to the backend administrator;

[0014] If not, then end.

[0015] Preferably, in step S2, the following steps are specifically included:

[0016] S21. Obtain browsing records of employees in the same position based on enterprise big data, and obtain browsing times of employees in the same position on different web pages;

[0017] S22. Calculate the central node of the browsing record of the employee in this position according to the website topology and the number of browsing times; the central node satisfies the following relationship:

[0018]

[0019] In the above formula, D represents the sum of the distances from the central node to the nodes corresponding to the web browsing records of the employees in the position in the website topology graph, D(P0,P j ) The central node P0 corresponding to the employee in this position to any node P in the website topology graph j The distance from node P0 to any node P j The minimum number of links to click, f(x) represents the number of links with node P j The weight function of the number of views x is negatively correlated with the node P j As the number of page views increases, f(x) becomes smaller.

[0020] S23, obtaining the distance from the central node to each node in the website topology map corresponding to the browsing record;

[0021] S24. Filter out several nodes with the shortest distance from the central node according to the website topology map to establish functional areas.

[0022] Preferably, in step S4, the following steps are specifically included:

[0023] S41, extracting webpage texts browsed by users and located in the functional area according to the enterprise big data to generate a browsing record set;

[0024] S42, obtaining the first webpage text of the webpage corresponding to the user request information;

[0025] S43, sequentially calculating sentence similarity, paragraph similarity, text similarity and total similarity between the browsing record set and the first webpage text.

[0026] Preferably, in step S43, the following steps are specifically included:

[0027] S431, calculating the sentence similarity between any web page text in the browsing record set and the sentence in the first web page text;

[0028] S432, calculating the paragraph similarity between any web page text in the browsing record set and the paragraph in the first web page text according to the sentence similarity;

[0029] S433, calculating the text similarity between any web page text in the browsing record set and the first web page text according to the paragraph similarity;

[0030] S434: Calculate the total similarity between the browsing record set and the first webpage text according to the text similarity.

[0031] Preferably, in step S432, the following steps are specifically included:

[0032] S4321, construct a structural sequence of paragraphs in any web page text and the first web page text in the browsing record set respectively; the expression of the structural sequence is:

[0033] DL0={J 01 ,J 02 ,...,J 0n}

[0034] DL1={J 11 ,J 12 ,...,J 1m}

[0035] In the above formula, DL0 represents the structural sequence of any paragraph in any web page text in the browsing record set, J 0n represents the nth sentence, DL1 represents the structural sequence of paragraphs in the first webpage text, and J 1m represents the mth sentence;

[0036] S4322, constructing a first similarity matrix of paragraphs in any web page text and the first web page text in the browsing record set;

[0037] S4323, traverse the first similarity matrix from left to right and from top to bottom, extract the maximum value of sentence similarity in the first similarity matrix, and delete the elements in the row and column corresponding to the maximum value of sentence similarity;

[0038] S4324, establishing a maximum value array, and adding the maximum value of the sentence similarity to the maximum value array;

[0039] S4325, deleting the maximum sentence similarity value added to the maximum value array in the first similarity matrix;

[0040] S4326, repeating steps S423 to S425 until the elements in the first similarity matrix are empty;

[0041] S4327, calculating the paragraph similarity between any web page text in the browsing record set and the paragraph in the first web page text; the calculation formula for the paragraph similarity is:

[0042]

[0043] in:

[0044] k = MIN(n, m)

[0045] In the above formula, SIM(DL0,DL1) represents the paragraph similarity, MAX i represents the similarity of the ith sentence in the maximum value array, and k represents the average coefficient.

[0046] Preferably, in step S2, the central node is a node in the website topology map, and the sum of distances from the node to the nodes in the website topology map corresponding to the web browsing records of the employee at the post is the shortest.

[0047] Preferably, in step S22, the position of the central node satisfies the following relationship:

[0048]

[0049] In the above formula, D represents the sum of the distances from the central node to the nodes corresponding to the web browsing records of the employees in the position in the website topology graph, D(P0,P j ) The central node P0 corresponding to the employee in this position to any node Pj in the website topology graph 的 Distance, which refers to the distance from node P0 to any node P j The minimum number of links to click, f(x) represents the number of links with node P j The weight function of the number of views x is negatively correlated with the node P j As the number of page views increases, f(x) becomes smaller.

[0050] Preferably, in step S4322, the expression of the first similarity matrix is:

[0051]

[0052] In the above formula, SIM(DL) represents the first similarity matrix, SIM(J 0n ,J 1m ) represents the sentence similarity between the nth sentence in any paragraph of any web page text in the browsing record set and the mth sentence in any paragraph of the first web page text.

[0053] Preferably, in step S434, the calculation formula of the total similarity is:

[0054]

[0055] In the above formula, SIM represents the total similarity between the browsing record set and the first web page text, S 1m represents the text similarity between the first webpage text and the mth different webpage text in the functional area, f(S 1m ) is an incremental function related to text similarity, and its value is related to S 1m is positively correlated with its numerical value, and its numerical range is (0, m).

[0056] A management system includes a processor and a memory, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the network information security management method based on big data is implemented.

[0057] Compared with the prior art, the present invention provides a network information security management method and system based on big data, which has the following beneficial effects:

[0058] 1. The present invention establishes functional areas through the browsing records of employees in enterprise positions, so that web pages that have not been visited by the employees in the position within a certain period of time but are related to their work can be identified, and then by comparing whether the request information of the employees in the position is located in the web page corresponding to the functional area, the first step of judging whether the employee's behavior is an intrusion behavior is achieved. Subsequently, for the web page corresponding to the request information that is not in the functional area, the total similarity between it and the browsing record set is calculated, so as to perform the second step of judging, and the request behavior corresponding to the request information with a total similarity less than the safety threshold is regarded as a dangerous behavior, and an alarm is issued to achieve the protection of the network information security of the enterprise intranet.

[0059] 2. The present invention establishes functional areas. Taking into account the fact that the employees in this position may not have entered all the web pages related to their work content in the past period of time, the central node is used as the starting point to obtain the distance between the web page corresponding to the browsing record and the central node, so that the appropriate distance can be set accordingly, and the nodes in the website topology map that are within an appropriate distance from the central node are included in the functional area.

[0060] 3. The present invention calculates the similarity between the web page content corresponding to the user's request information and the content corresponding to his browsing record set by calculating sentence similarity, paragraph similarity, text similarity and total similarity in sequence, thereby determining whether the user is working on content unrelated to his work content, and will not directly intercept the user because the user has not visited the location. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0062] Figure 1 The present invention is a flowchart of a network information security management method based on big data. DETAILED DESCRIPTION

[0063] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods, so that the implementation process of how the present application uses technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly.

[0064] Those skilled in the art can understand that all or part of the steps in the following embodiments can be completed by instructing the relevant hardware through a program, so the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0065] A network information security management method based on big data, the method comprising the following steps:

[0066] S1. Obtain enterprise big data of enterprise users logging into the enterprise website, the enterprise big data includes the web page addresses, website topology and website content of employees in different positions of the enterprise logging into the enterprise website, and classify the enterprise big data according to the employee's position; that is, each position may have multiple employees, and the historical browsing web pages of each employee in the position are collected to obtain enterprise big data classified by employee position. The browsing content of employees in each position is related to their work content, so the historical browsing records of the employees in this position are used for subsequent calculations to determine whether there is a risk in the request information of the employees in this position.

[0067] S2. Calculate the central node of the web browsing records of employees in the same position based on the enterprise big data and the website topology map. The sum of the distances from the node to the nodes in the website topology map corresponding to the web browsing records of employees in the same position is the shortest. According to the distances between the central node and each node in the web browsing records, determine several nodes with the shortest distances as functional areas. In order to further illustrate the calculation method of the central node and the functional area, in step S2, the following steps are specifically included:

[0068] S21. Obtain browsing records of employees in the same position based on enterprise big data, and obtain the number of times employees in the same position browse different web pages; if there are multiple employees in the position, the browsing records of employees in the same position are the sum of the browsing records of multiple employees. The enterprise can obtain employees' browsing records by installing network monitoring software and web browsing record tools.

[0069] S22. Calculate the central node of the browsing record of the employee in this position according to the website topology and the number of browsing times; the central node satisfies the following relationship:

[0070]

[0071] In the above formula, D represents the sum of the distances from the central node to the nodes corresponding to the web browsing records of the employees in the position in the website topology graph, D(P0,P j ) The central node P0 corresponding to the employee in this position to any node P in the website topology graph j The distance from node P0 to any node P j The minimum number of links to click, f(x) represents the number of links with node P j The weight function of the number of views x is negatively correlated with the node P j As the number of page views increases, f(x) becomes smaller.

[0072] S23, obtaining the distance from the central node to each node in the website topology map corresponding to the browsing record;

[0073] S24. According to the website topology map, several nodes with the smallest distance from the central node are screened out to establish functional areas. That is, the web pages represented by a small number of nodes with a large distance from the central node in the browsing history are eliminated, and some nodes of the website topology map within the distance are added to the browsing history, so that the functional areas can be obtained. This is because the enterprise intranet generally adopts a tree structure for the convenience of management and office work, and arranges related content under a unified main title. There may be sub-titles under the main title. Therefore, the work scope of employees in different positions is generally under titles of different levels. Employees in one position may use different parts of the content under the title because of their current different work content. However, all the content under the title is generally within their authority and may be related to their work, so it is set as a functional area.

[0074] S3, obtaining the first node position of the web page corresponding to the user request information in the website topology map, and determining whether the first node position is located in the functional area;

[0075] If so, then end;

[0076] If not, proceed to step S4;

[0077] S4. Calculate the total similarity between the webpage text in the functional area and the webpage text content corresponding to the request information. When the intranet user obtains the company's privacy through his account, he may obtain content that is not strongly related to his work content. Therefore, it is necessary to further obtain his work content in the future, and compare the webpage content corresponding to the user's request information with his work content to determine whether his behavior is for work, so as to determine whether he is stealing company secrets in the future. In step S4, the following steps are specifically included:

[0078] S41. Extract the webpage texts browsed by the user and located in the functional area according to the enterprise big data to generate a browsing record set; the browsing record set can be expressed as: T = {T1, T2, T3, ..., T m}

[0079] In the above formula, T represents the browsing record set, T m represents the mth different web page text in the functional area obtained from the enterprise big data;

[0080] S42, obtaining the first webpage text of the webpage corresponding to the user request information;

[0081] S43, calculating the sentence similarity, paragraph similarity, text similarity and total similarity between the browsing record set and the first webpage text; in order to further provide a better method for calculating the sentence similarity, paragraph similarity, text similarity and total similarity, in step S43, the following steps are specifically included:

[0082] S431, calculating the sentence similarity between any web page text in the browsing record set and the sentence in the first web page text;

[0083] S432, calculating the paragraph similarity between any web page text in the browsing record set and the paragraph in the first web page text according to the sentence similarity; in order to further provide a better method for calculating paragraph similarity, in step S432, the following steps are specifically included:

[0084] S4321, construct a structural sequence of paragraphs in any web page text and the first web page text in the browsing record set respectively; the expression of the structural sequence is:

[0085] DL0={J 01 ,J 02 ,...,J 0n}

[0086] DL1={J 11 ,J 12 ,...,J 1m}

[0087] In the above formula, DL0 represents the structural sequence of any paragraph in any web page text in the browsing record set, J 0n represents the nth sentence, DL1 represents the structural sequence of paragraphs in the first webpage text, and J 1m represents the mth sentence;

[0088] S4322, constructing a first similarity matrix of paragraphs in any web page text and the first web page text in the browsing record set; the expression of the first similarity matrix is:

[0089]

[0090] In the above formula, SIM(DL) represents the first similarity matrix, SIM(J 0n ,J 1m ) represents the sentence similarity between the nth sentence in any paragraph of any web page text in the browsing record set and the mth sentence in any paragraph of the first web page text;

[0091] S4323, traverse the first similarity matrix from left to right and from top to bottom, extract the maximum value of sentence similarity in the first similarity matrix, and delete the elements in the row and column corresponding to the maximum value of sentence similarity;

[0092] S4324, establish a maximum value array, and add the maximum value of sentence similarity to the maximum value array; the expression of the maximum value array is: MAX={MAX1,MAX2,...,MAX i};

[0093] In the above formula, MAX represents the maximum value array, i represents the similarity of the i-th sentence added to the maximum value array from the first similarity matrix;

[0094] S4325, deleting the maximum sentence similarity value added to the maximum value array in the first similarity matrix;

[0095] S4326, repeating steps S423 to S425 until the elements in the first similarity matrix are empty;

[0096] S4327, calculating the paragraph similarity between any web page text in the browsing record set and the paragraph in the first web page text; the calculation formula for the paragraph similarity is:

[0097]

[0098] in:

[0099] k = MIN(n, m)

[0100] In the above formula, SIM(DL0,DL1) represents the paragraph similarity, MAX i represents the similarity of the ith sentence in the maximum value array, k represents the average coefficient, and MIN(·) represents taking the minimum value of the elements in brackets;

[0101] S433, calculating the text similarity between any web page text in the browsing record set and the first web page text according to the paragraph similarity, the calculation method of the text similarity is similar to the calculation formula of the paragraph similarity, which is also to first construct a text structure matrix composed of a plurality of paragraphs, and then construct a similarity matrix between any web page text in the browsing record set and the first web page text, and then obtain the corresponding maximum value array from the similarity matrix according to the same method, and finally calculate the text similarity according to the maximum value array in the same method;

[0102] S434, calculating the total similarity between the browsing record set and the first webpage text according to the text similarity; the calculation formula of the total similarity is:

[0103]

[0104] In the above formula, SIM represents the total similarity between the browsing record set and the first web page text, S 1m represents the text similarity between the first webpage text and the mth different webpage text in the functional area, f(S 1m ) is an incremental function related to text similarity, and its value is related to S 1m is positively correlated with its numerical value, and its numerical range is (0, m).

[0105] S5. Set a security threshold, and determine whether the information requested by the enterprise employee is a risky behavior based on whether the total similarity is less than the security threshold;

[0106] If yes, the employee's request behavior is blocked, and the employee's IP address and hardware address are output to the backend administrator;

[0107] If not, then end.

[0108] Through the method mentioned in the present invention, according to the general tree structure characteristics of the enterprise intranet, the central node of the employee in the same position is first calculated according to the browsing history of the employee in the same position in the website topology map, and then the distance between the central node and the node in the website topology map corresponding to the browsing history is calculated. The range of the functional area is calculated through the distance. When the server obtains the request information of an employee in a certain position, it first identifies whether the web page corresponding to the request information is located in the functional area to determine whether the request content is his work requirement. When it is not located in the functional area, other parts of the website may also contain content related to his work, because some jobs overlap between positions, and the related content may only be placed in one position. Therefore, by further calculating the total similarity, it is compared whether the web page corresponding to the request information is related to its work content, and through the security threshold, the request information corresponding to the total similarity below the security threshold is identified as a risky behavior, and the corresponding device address and employee account corresponding to the corresponding risky behavior are sent to facilitate the manager to conduct subsequent investigations.

[0109] Corresponding to the management method mentioned in the above embodiment, the present invention also provides a network information security management system based on big data, including a processor and a memory, the memory is used to store a computer program, and when the computer program is executed by the processor, the network information security management method based on big data is implemented.

[0110] The above implementation methods have been described in detail. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network information security management method based on big data, characterized in that: The steps include: S1. Obtain enterprise big data of enterprise users logging into the enterprise website, wherein the enterprise big data includes web page addresses, website topology and website content of employees in different positions of the enterprise logging into the enterprise website, and classify the enterprise big data according to the employee positions; S2. Calculate the central node of the website topology area corresponding to the web browsing records of employees in the same position based on the enterprise big data, and determine several nodes with the shortest distance as the functional area based on the distance between the central node and each node in the web browsing records; In step S2, the following steps are specifically included: S21. Obtain browsing records of employees in the same position based on enterprise big data, and obtain browsing times of employees in the same position on different web pages; S22. Calculate the central node of the browsing record of the employee in this position according to the website topology and the number of browsing times; the central node satisfies the following relationship: In the above formula, It represents the sum of the distances from the central node to the nodes corresponding to the web browsing records of the employees in this position in the website topology diagram. The central node corresponding to the employee in this position Go to any node in the website topology diagram The distance from the node To any node The minimum number of links to click. Representation and Node Views Negatively correlated weight function, as the node The increase in the number of page views, The smaller; S23, obtaining the distance from the central node to each node in the website topology map corresponding to the browsing record; S24, selecting a number of nodes with the shortest distance from the central node according to the website topology map to establish functional areas; S3, obtaining the first node position of the web page corresponding to the user request information in the website topology map, and determining whether the first node position is located in the functional area; If so, then end; If not, proceed to step S4; S4, calculating the total similarity between the webpage text in the functional area and the webpage text content corresponding to the request information; S5. Set a security threshold, and determine whether the information requested by the enterprise employee is a risky behavior based on whether the total similarity is less than the security threshold; If yes, the employee's request behavior is blocked, and the employee's IP address and hardware address are output to the backend administrator; If not, then end.

2. The management method according to claim 1, characterized in that: In step S4, the following steps are specifically included: S41, extracting webpage texts browsed by users and located in the functional area according to the enterprise big data to generate a browsing record set; S42, obtaining the first webpage text of the webpage corresponding to the user request information; S43, sequentially calculating sentence similarity, paragraph similarity, text similarity and total similarity between the browsing record set and the first webpage text.

3. The management method according to claim 2, characterized in that: In step S43, the following steps are specifically included: S431, calculating the sentence similarity between any web page text in the browsing record set and the sentence in the first web page text; S432, calculating the paragraph similarity between any web page text in the browsing record set and the paragraph in the first web page text according to the sentence similarity; S433, calculating the text similarity between any web page text in the browsing record set and the first web page text according to the paragraph similarity; S434: Calculate the total similarity between the browsing record set and the first webpage text according to the text similarity.

4. The management method according to claim 3, characterized in that: In step S432, the following steps are specifically included: S4321, construct a structural sequence of paragraphs in any web page text and the first web page text in the browsing record set respectively; the expression of the structural sequence is: In the above formula, Represents a structural sequence of any paragraph in any web page text in the browsing record set. represents the nth sentence, represents the structural sequence of paragraphs in the first web page text, represents the mth sentence; S4322, constructing a first similarity matrix of paragraphs in any web page text and the first web page text in the browsing record set; S4323, traverse the first similarity matrix from left to right and from top to bottom, extract the maximum value of sentence similarity in the first similarity matrix, and delete the elements in the row and column corresponding to the maximum value of sentence similarity; S4324, establishing a maximum value array, and adding the maximum value of the sentence similarity to the maximum value array; S4325, deleting the maximum sentence similarity value added to the maximum value array in the first similarity matrix; S4326, repeating steps S423 to S425 until the elements in the first similarity matrix are empty; S4327, calculating the paragraph similarity between any web page text in the browsing record set and the paragraph in the first web page text; the calculation formula for the paragraph similarity is: in: In the above formula, Indicates paragraph similarity, represents the similarity of the ith sentence in the maximum value array, and k represents the average coefficient.

5. The management method according to claim 1, characterized in that: In step S2, the central node is a node in the website topology map, and the sum of the distances from the node to the nodes in the website topology map corresponding to the web browsing records of the employee at the post is the shortest.

6. The management method according to claim 4, characterized in that: In step S4322, the expression of the first similarity matrix is: In the above formula, represents the first similarity matrix, It represents the sentence similarity between the nth sentence in any paragraph of any web page text in the browsing record set and the mth sentence in any paragraph of the first web page text.

7. The management method according to claim 3, characterized in that: In step S434, the calculation formula of the total similarity is: In the above formula, represents the total similarity between the browsing record set and the first web page text, represents the text similarity between the first webpage text and the mth different webpage text in the functional area, is an incremental function related to text similarity, and its value is The value of is positively correlated, and its value range is .

8. A management system for implementing the management method according to any one of claims 1 to 7, characterized in that: It includes a processor and a memory, the memory is used to store a computer program, and when the computer program is executed by the processor, it implements the network information security management method based on big data as described in any one of claims 1 to 7.

Images