A network security protection method and system

Abstract

The present invention discloses a network security protection method and system, which relates to the field of network security technology, including obtaining user behavior data of a target user and determining the user's current network security level; automatically adjusting weight parameters of an activity index, a login anomaly index, a running index and an operation anomaly index according to the real-time status and historical data of the network environment; establishing a hybrid state model using the collected user behavior data to identify and predict normal and abnormal behavior patterns; calculating the comprehensive security parameters of the target user based on the dynamically adjusted weight parameters, and then determining the user's overall security level; dynamically adjusting the network access control strategy according to the user's security level. The present invention forms a set of advanced network security protection mechanisms by integrating user behavior analysis, environmental adaptability weight adjustment, hybrid state model prediction, comprehensive security parameter calculation and dynamic access control strategy.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security protection method and system. Background Art

[0002] With the rapid development of information technology, the Internet has become an indispensable information exchange platform in modern society, but the network security issues it brings are becoming increasingly prominent and have become one of the important factors restricting the progress of the digital age. Traditional network security protection measures focus on static defense, including firewalls and intrusion detection systems. Although these technologies can resist external attacks to a certain extent, they have limited ability to monitor and respond to abnormal internal user behaviors in a timely manner. In recent years, with the rise of big data and artificial intelligence technologies, network security protection has gradually transformed towards intelligent and active defense, striving to achieve efficient and accurate threat identification and response in complex and changing network environments.

[0003] Despite this, existing technologies still face many challenges in practical applications. First, user behavior analysis often relies on a fixed indicator system and weight distribution, and lacks adaptability to dynamic changes in the network environment. When network traffic increases abnormally and new attack methods emerge, the fixed weight parameters cannot accurately reflect the current security situation, resulting in frequent false positives and missed reports. Secondly, most existing behavior recognition models are built based on a single technology and simple machine learning models. These models perform poorly when processing high-dimensional, nonlinear data and have difficulty capturing subtle changes and complex patterns in user behavior. In addition, the adjustment of network access control policies often lags behind the occurrence of security incidents, and cannot flexibly adjust access rights according to the user's real-time security level, leaving security risks. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a network security protection method and system to solve the problem that user behavior analysis often relies on a fixed indicator system and weight distribution, lacks adaptability to dynamic changes in the network environment, and when network traffic increases abnormally and new attack methods emerge, the fixed weight parameters cannot accurately reflect the current security situation, resulting in frequent false alarms and missed reports. Secondly, most of the existing behavior recognition models are built based on a single technology and simple machine learning models. These models perform poorly when processing high-dimensional and nonlinear data, and have difficulty capturing subtle changes and complex patterns in user behavior. In addition, the adjustment of network access control policies often lags behind the occurrence of security incidents, and cannot flexibly adjust access rights according to the user's real-time security level, thus leaving security risks.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a network security protection method, which includes:

[0008] Obtain user behavior data of target users and determine the user's current network security level;

[0009] Automatically adjust the weight parameters of the activity index, login abnormality index, operation index, and operation abnormality index based on the real-time status and historical data of the network environment;

[0010] Use the collected user behavior data to build a mixed state model to identify and predict normal and abnormal behavior patterns;

[0011] Based on the dynamically adjusted weight parameters, the comprehensive security parameters of the target user are calculated to determine the user's overall security level;

[0012] Dynamically adjust network access control policies based on the user's overall security level.

[0013] As a preferred solution of the network security protection method of the present invention, wherein: the user behavior data includes an activity index AI, a login abnormality index LEI, a running index RI and an operation abnormality index OEI;

[0014] Determining the current network security level of the user includes the following steps: a comprehensive security score is performed based on the activity index AI, the login anomaly index LEI, the operation index RI, and the operation anomaly index OEI. The expression is:

[0015]

[0016] Among them, SS represents the comprehensive safety score, ∫ represents the integral symbol, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor, ω AI (t),ω LEI (t),ω RI (t),ω OEI (t) represents the dynamic weights of AI, LEI, RI and OEI. AI(t), LEI(t), RI(t) and OEI(t) represent the values ​​of activity index, login abnormality index, operation index and operation abnormality index at time t respectively. dt represents the weighted accumulation of all instantaneous behaviors from time 0 to T.

[0017] The comprehensive security score SS divides users into different preliminary security levels.

[0018] As a preferred solution of the network security protection method of the present invention, the weight parameters of the activity index, login abnormality index, operation index and operation abnormality index are automatically adjusted according to the real-time status and historical data of the network environment. The specific steps are as follows:

[0019] Collect the real-time status of the network environment;

[0020] Analyze historical data to provide a basis for automatically adjusting weight parameters;

[0021] The real-time status data and historical data are combined into a set of feature vectors, expressed as:

[0022]

[0023] Among them, X t represents the feature vector, n represents the number of features, and t represents the time point;

[0024] Define the loss function as L(ω, X t );

[0025] At each time step t, based on the feature vector X t and the weight vector ω at the previous time step t-1 t-1 , the online gradient descent OGD algorithm is used to adjust the weight parameter ω in real time t , the expression is:

[0026]

[0027] Among them, ω t represents the weight vector at time t, ω t-1 represents the weight vector at the previous time step t-1, η represents the learning rate, Denotes the loss function L with respect to the weight vector ω t-1 In the current feature vector X t The gradient vector under .

[0028] As a preferred solution of the network security protection method of the present invention, the method of using the collected user behavior data to train the mixed state model to identify and predict normal and abnormal behavior patterns is specifically performed as follows:

[0029] Construct a hybrid state model that integrates the feature representation H(t) of LSTM and CNN and the state transition information of the hidden Markov model HMM. t For feature extraction and pattern learning, the expression is:

[0030] y(t)=Softmax(W2·ReLU(W1·[X t ;H(t)]+b1)+W3·MaxProbTrans[αt ]+b2)

[0031] Among them, y(t) represents the probability value predicted at time step t, Softmax and ReLU are activation functions, H(t) represents the current hidden state, W1 and W2 are the weight matrices of the first and second layers respectively, W3 represents the third weight matrix, which is used to map the state transfer information to the output layer, b1 and b2 are the bias items of the first and second layers respectively, MaxProbTrans represents the maximum probability value in the state transfer matrix, α t Represents the state probability distribution of the current time step;

[0032] Set a threshold U and compare the predicted value y(t) with the threshold U;

[0033] When y(t)>U, it is judged as normal behavior;

[0034] When y(t)≤U, it is judged as abnormal behavior.

[0035] As a preferred solution of the network security protection method of the present invention, wherein: the comprehensive security parameters of the target user are calculated based on the dynamically adjusted weight parameters, and then the overall security level of the user is determined, and the specific steps are:

[0036] Based on the adjusted weight parameter ω=[ω AI ,ω LEI ,ω RI ,ω OEI ], calculate the first reliability value and the second reliability value;

[0037] The first reliability value is expressed as:

[0038]

[0039] Among them, R1 represents the first reliable value, ω i (t) represents the weight of indicator i at time t, X i (t) represents the value of indicator i at time t, γ is a constant coefficient, i≠j represents the pairing between indicators i and j, ω ij (t) represents the interaction weight of indicators i and j at time t, Z represents the normalization factor, and X j (t) represents the value of index j at time t, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor;

[0040] The second reliability value is expressed as:

[0041]

[0042] Where R2 represents the second reliable value, y(t) represents the predicted probability value of the mixed state model at time t, α and β are the weight coefficients of the weighted average of the prediction model output and the behavior index, σ represents the standard deviation, Var[y(t)] and μ[y(t)] represent the variance and mean of the predicted value y(t) over time, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor;

[0043] Based on R1 and R2, a composite index is defined to determine the user's overall security level, expressed as:

[0044]

[0045] Among them, CS represents the comprehensive safety score, Represents the weight factor.

[0046] As a preferred solution of the network security protection method of the present invention, the network access control strategy is dynamically adjusted according to the overall security level of the user, and the specific steps are:

[0047] Based on the user's comprehensive security score CS, the corresponding policy set is automatically selected and applied, and the policy selection function is constructed. The expression is:

[0048] P(CS)={LSL, if CS≤θ1 MSL, ifθ1<CS≤θ2HSL, if CS>θ2}

[0049] Among them, P(CS) represents the policy selection function, LSL, MSL, and HSL represent the policy sets of low, medium, and high security levels, respectively, if means if, and θ1 and θ2 are the thresholds of the comprehensive security score CS.

[0050] As a preferred solution of the network security protection method of the present invention, the specific steps of dynamically adjusting the network access control strategy are as follows:

[0051] Set thresholds θ1 and θ2 according to the comprehensive safety score CS;

[0052] When CS≤θ1, the user is judged to have a low security level, and a one-time SMS verification code is sent to the registered mobile phone number to verify the identity. The user needs to enter the verification code within the specified time to pass the verification. After passing the verification, access to sensitive resources and key systems is restricted, and only necessary services are open to reduce network resource allocation. Failure to enter the verification code within the specified time is considered a verification failure and the user is denied access;

[0053] When θ1<CS≤θ2, the user is judged to be at a medium security level, and a one-time SMS verification code is sent to the registered mobile phone number to verify the identity. The user needs to enter the verification code within the specified time to pass the verification. After passing the verification, system resources and function access are limited according to the user role. The access log is reviewed regularly and suspicious behavior is warned. Failure to enter the verification code within the specified time is considered a verification failure and the user is denied access;

[0054] When CS>θ2, the user is judged to be at a high security level and needs to enter a preset six-digit password to pass the verification. After successful verification, full access rights are enabled, and the user can freely access resources according to work needs, and network resources are allocated preferentially to ensure business smoothness.

[0055] In a second aspect, the present invention provides a network security protection system, including a collection module, an adjustment module, an analysis module, an evaluation module and an execution module;

[0056] The acquisition module is responsible for collecting the user behavior data of the target user in real time, collecting the real-time status data and historical data of the network environment, and at the same time, it is also responsible for normalizing the collected data;

[0057] The adjustment module includes automatically adjusting the weight parameters of the activity index, login abnormality index, operation index and operation abnormality index based on the collected real-time network environment status and historical data analysis;

[0058] The analysis module includes using a hybrid state model to conduct in-depth analysis of user behavior data to achieve identification and prediction of normal and abnormal behavior patterns. By training the model, setting thresholds to determine whether the behavior is normal or not, and providing users with immediate security risk feedback;

[0059] The evaluation module includes comprehensively considering the user behavior indicators and behavior pattern prediction results after weight adjustment, and further determining the user's overall security level by calculating the comprehensive security score CS of the target user;

[0060] The execution module includes dynamically adjusting the network access control strategy according to the user's comprehensive security score. At the same time, the system continuously monitors the changes in the user's security level to ensure timely adjustment and implementation of the strategy.

[0061] In a third aspect, an embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the network security protection method described in the first aspect of the present invention is implemented.

[0062] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the network security protection method described in the first aspect of the present invention is implemented.

[0063] The beneficial effects of the present invention are as follows: the present invention forms a set of advanced network security protection mechanisms by integrating user behavior analysis, environmental adaptability weight adjustment, hybrid state model prediction, comprehensive security parameter calculation and dynamic access control strategy. It collects user behavior data to evaluate the security level and ensures the accuracy of basic protection. Then, according to the real-time status of the network environment and historical data analysis, it intelligently adjusts the weight parameters to enhance the timeliness and pertinence of the protection measures. By constructing a hybrid state model, it can not only identify known threats, but also predict unknown risks, and improve the foresight and initiative of protection. The dynamic calculation of comprehensive security parameters provides an accurate basis for user customized security strategies. Finally, the dynamic access control implemented according to the user's security level balances the needs of security and convenience and optimizes the network usage experience. On the whole, the present invention improves the intelligence level of network security protection, realizes a deep understanding of user behavior and efficient response, and effectively resists network threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0065] Figure 1 This is a flow chart of the network security protection method in Example 1.

[0066] Figure 2 This is a flow chart of the comprehensive safety score in Example 1. DETAILED DESCRIPTION

[0067] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0068] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0069] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0070] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a network security protection method, comprising the following steps:

[0071] Obtain the user behavior data of the target user and determine the user's current network security level.

[0072] User behavior data includes activity index AI, login abnormality index LEI, operation index RI and operation abnormality index OEI;

[0073] Determining the user's current network security level includes the following steps: a comprehensive security score is calculated based on the activity index AI, login anomaly index LEI, operation index RI, and operation anomaly index OEI. The expression is:

[0074]

[0075] Among them, SS represents the comprehensive safety score, ∫ represents the integral symbol, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor, ω AI (t),ω LEI (t),ω RI (t),ω OEI (t) represents the dynamic weights of AI, LEI, RI and OEI. AI(t), LEI(t), RI(t) and OEI(t) represent the values ​​of activity index, login abnormality index, operation index and operation abnormality index at time t respectively. dt represents the weighted accumulation of all instantaneous behaviors from time 0 to T.

[0076] The value of the comprehensive security score SS ranges from 0 to 1, which divides users into different preliminary security levels;

[0077] Preliminary security levels, including low security level, medium security level, and high security level;

[0078] When SS≤0.3, the user is judged to have a low security level, indicating that the user's behavior is significantly abnormal and risky;

[0079] When 0.3<SS≤0.7, the user is judged to be at a medium security level, indicating that the user's behavior may have certain security risks but is still within the controllable range;

[0080] When 0.7<SS≤1, the user is judged to be at a high security level, indicating that users at this level exhibit a highly normal behavior pattern and have a low security risk.

[0081] According to the real-time status and historical data of the network environment, the weight parameters of the activity index, login abnormality index, operation index and operation abnormality index are automatically adjusted.

[0082] Collect the real-time status of the network environment, including but not limited to network traffic, attack event frequency, and new threat intelligence update rate;

[0083] Analyze historical data to provide a basis for automatically adjusting weight parameters;

[0084] The real-time status data and historical data are combined into a set of feature vectors, expressed as:

[0085]

[0086] Among them, X t represents the feature vector, n represents the number of features, and t represents the time point;

[0087] Define the loss function L(ω, X t ), the expression is:

[0088]

[0089] Among them, L(ω, X t ) represents the loss function, which means that at time t, given the feature vector X t and weight vector ω=[ω AI ,ω LEI ,ω RI ,ω OEI ], BaseLoss(ω, X t ) represents the basic loss term, λ and μ represent the regularization coefficients, represents the square of the L2 norm of the weight vector ω;

[0090] At each time step t, based on the feature vector X t and the weight vector ω at the previous time step t-1 t-1 , the online gradient descent OGD algorithm is used to adjust the weight parameter ω in real time t , the expression is:

[0091]

[0092] Among them, ω t Represents the weight vector at time t, including the weight values ​​of the activity index, login abnormality index, operation index, and operation abnormality index, ωt-1 represents the weight vector at the previous time step t-1, η represents the learning rate, Denotes the loss function L with respect to the weight vector ω t-1 In the current feature vector X t The gradient vector under ;

[0093] The process of analyzing historical data is:

[0094] Collect data from various log and intelligence sources, including but not limited to user login logs, operation logs, system event logs, network traffic records, and external threat intelligence sources;

[0095] Clean and normalize the data to ensure data quality;

[0096] Statistical analysis is used to identify the user's regular login time, common function operations and activity area behavior patterns, and the abnormal behavior detection algorithm SVM is used to mark activities that deviate significantly from normal behavior;

[0097] By analyzing the time, type, severity, and affected users of historical security events, we can reveal patterns of concentrated periods of security events and common attack types.

[0098] Use the collected user behavior data to build a mixed state model to identify and predict normal and abnormal behavior patterns.

[0099] Construct a hybrid state model that integrates the feature representation H(t) of LSTM and CNN and the state transition information of the hidden Markov model HMM. t For feature extraction and pattern learning, the expression is:

[0100] y(t)=Softmax(W2·ReLU(W1·[X t ;H(t)]+b1)+W3·MaxProbTrans[α t ]+b2)

[0101] Among them, y(t) represents the probability value predicted at time step t, Softmax and ReLU are activation functions, H(t) represents the current hidden state, W1 and W2 are the weight matrices of the first and second layers respectively, W3 represents the third weight matrix, which is used to map the state transfer information to the output layer, b1 and b2 are the bias items of the first and second layers respectively, MaxProbTrans represents the maximum probability value in the state transfer matrix, α t Represents the state probability distribution of the current time step;

[0102] Set a threshold U and compare the predicted value y(t) with the threshold U;

[0103] When y(t)>U, it is judged as normal behavior;

[0104] When y(t)≤U, it is judged as abnormal behavior;

[0105] Mixed state model, including input layer, convolution layer, fully connected layer and anti-overfitting layer;

[0106] In the present invention, the value of the threshold U is 0.5.

[0107] Based on the dynamically adjusted weight parameters, the comprehensive security parameters of the target user are calculated to determine the user's overall security level.

[0108] Based on the dynamically adjusted weight parameters, the comprehensive security parameters of the target user are calculated to determine the user's overall security level. The specific steps are as follows:

[0109] Based on the adjusted weight parameter ω=[ω AI ,ω LEI ,ω RI ,ω OEI ], calculate the first reliability value and the second reliability value;

[0110] The first reliable value is expressed as:

[0111]

[0112] Among them, R1 represents the first reliability value, which represents a quantitative indicator reflecting the activity index, login abnormality index, operation index and operation abnormality index, ω i (t) represents the weight of indicator i at time t, X i (t) represents the value of indicator i at time t, γ is a constant coefficient, i≠j represents the pairing between indicators i and j, ω ij (t) represents the interaction weight of indicators t and j at time t, Z represents the normalization factor, and X j (t) represents the value of index j at time t, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor;

[0113] The second reliable value is expressed as:

[0114]

[0115] Among them, R2 represents the second reliable value, which reflects the comprehensive evaluation of the dynamic changes of the behavior pattern, y(t) represents the predicted probability value of the mixed state model at time t, α and β are the weight coefficients of the weighted average of the prediction model output and the behavior index, σ represents the standard deviation, Var[y(t)] and μ[y(t)] represent the variance and mean of the predicted value y(t) over time, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor;

[0116] Based on R1 and R2, a composite index is defined to determine the user's overall security level, expressed as:

[0117]

[0118] Among them, CS represents the comprehensive safety score, which ranges from 0 to 1. represents the weight factor;

[0119] Comprehensive safety parameters, including a first reliability value and a second reliability value;

[0120] The normalization factor Z is expressed as:

[0121]

[0122] Among them, Z represents the normalization factor calculated last, It represents the maximum value of index i in the entire time period from 0 to T. represents the square of the normalized weighted value of index i,

[0123] Indicates calculating the square of the normalized value of the cross term.

[0124] Dynamically adjust network access control policies based on the user's overall security level.

[0125] Based on the user's comprehensive security score CS, the corresponding policy set is automatically selected and applied, and the policy selection function is constructed. The expression is:

[0126] P(CS)={LSL, if CS≤θ1MSL, ifθ1<CS≤θ2HSL, if CS>θ2}

[0127] Among them, P(CS) represents the policy selection function, LSL, MSL, and HSL represent the policy sets of low, medium, and high security levels, respectively, if represents if, and θ1 and θ2 are the thresholds of the comprehensive security score CS;

[0128] The system monitors the user's comprehensive security score CS in real time. Once the security level changes, the policy adjustment mechanism is immediately triggered and automatically switches to the corresponding policy set.

[0129] According to the comprehensive safety score CS, thresholds θ1 and θ2 are set, where θ1 is the upper limit of the low safety level and θ2 is the boundary between the medium safety level and the high safety level;

[0130] When CS≤θ1, the user is judged to have a low security level, and a one-time SMS verification code is sent to the registered mobile phone number to verify the identity. The user needs to enter the verification code within the specified time to pass the verification. After passing the verification, access to sensitive resources and key systems is restricted, and only necessary services are open to reduce network resource allocation. Failure to enter the verification code within the specified time is considered a verification failure and the user is denied access;

[0131] When θ1<CS≤θ2, the user is judged to be at a medium security level, and a one-time SMS verification code is sent to the registered mobile phone number to verify the identity. The user needs to enter the verification code within the specified time to pass the verification. After passing the verification, system resources and function access are limited according to the user role. The access log is reviewed regularly and suspicious behavior is warned. Failure to enter the verification code within the specified time is considered a verification failure and the user is denied access;

[0132] When CS>θ2, the user is judged to be at a high security level and needs to enter a preset six-digit password to pass the verification. After successful verification, full access rights are enabled, and the user can freely access resources according to work needs, and network resources are allocated preferentially to ensure business smoothness;

[0133] The value of θ1 is 0.3 and the value of θ2 is 0.8.

[0134] This embodiment also provides a network security protection system, including: a collection module, an adjustment module, an analysis module, an evaluation module and an execution module;

[0135] The acquisition module is responsible for collecting the user behavior data of the target users in real time, collecting the real-time status data and historical data of the network environment, and at the same time, it is also responsible for normalizing the collected data;

[0136] An adjustment module, including automatic adjustment of weight parameters of activity index, login abnormality index, operation index and operation abnormality index based on the collected real-time network environment status and historical data analysis;

[0137] The analysis module uses a hybrid state model to conduct in-depth analysis of user behavior data, identify and predict normal and abnormal behavior patterns, and provide users with immediate security risk feedback by training models and setting thresholds to determine whether behavior is normal or not.

[0138] The evaluation module includes comprehensive consideration of the user behavior indicators and behavior pattern prediction results after weight adjustment, and further determines the user's overall security level by calculating the target user's comprehensive security score CS;

[0139] The execution module dynamically adjusts the network access control policy based on the user's comprehensive security score. At the same time, the system continuously monitors changes in user security levels to ensure timely adjustment and implementation of policies.

[0140] This embodiment also provides a computer device, which is suitable for the network security protection method, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the network security protection method proposed in the above embodiment.

[0141] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0142] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the network security protection method proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0143] In summary, the present invention forms a set of advanced network security protection mechanisms by integrating user behavior analysis, environmental adaptability weight adjustment, hybrid state model prediction, comprehensive security parameter calculation and dynamic access control strategy. It collects user behavior data to evaluate the security level and ensures the accuracy of basic protection. Then, according to the real-time status of the network environment and historical data analysis, it intelligently adjusts the weight parameters to enhance the timeliness and pertinence of the protection measures. By constructing a hybrid state model, it can not only identify known threats, but also predict unknown risks, and improve the foresight and initiative of protection. The dynamic calculation of comprehensive security parameters provides an accurate basis for user customized security strategies. Finally, the dynamic access control implemented according to the user's security level balances the needs of security and convenience and optimizes the network usage experience. On the whole, the present invention improves the intelligence level of network security protection, realizes a deep understanding of user behavior and efficient response, and effectively resists network threats.

[0144] Example 2

[0145] Referring to Table 1, which is the second embodiment of the present invention, in order to further verify the advancement of the present invention, experimental simulation data of the network security protection method is provided.

[0146] In this embodiment, we simulated the behavior of a group of target users in the network environment to evaluate and verify the proposed network security protection method. First, we constructed a data set containing 1,000 virtual users. The behavior patterns of these users covered normal and abnormal situations to ensure the diversity and representativeness of the experiment. The data set includes key parameters such as activity index AI, login anomaly index LEI, operation index RI, and operation anomaly index OEI. The data range covers two consecutive weeks of network activity records.

[0147] Activity Index AI: records the frequency of user activities within a specific time period, using the number of logins per hour as a quantitative indicator.

[0148] Login Anomaly Index LEI: It is measured by monitoring the login failure rate and the number of logins during abnormal periods. An abnormal login ratio exceeding 5% is considered abnormal.

[0149] Operation Index RI: reflects the intensity of user resource usage, calculated based on CPU and memory usage. If it is higher than 90%, it is considered to be a potential risk.

[0150] Operational Abnormality Index (OEI): monitors the frequency of abnormal operations, such as frequent attempts to access restricted resources, and sets the threshold to more than once per hour.

[0151] Using historical data and real-time network status, we apply the online gradient descent (OGD) algorithm to automatically adjust the weight parameters of the above four indexes. By analyzing the network attack events and security logs in the past three months, we define a feature vector X t , including network traffic and known threat activity frequency dimensions. The loss function L(ω, X t ) is designed to minimize the difference between the prediction error and the actual safety incident. The learning rate η is set to 0.01 to balance the convergence speed and stability.

[0152] Mixed state model training

[0153] The constructed hybrid state model integrates the feature representation of long short-term memory network (LSTM) and convolutional neural network (CNN) combined with hidden Markov model (HMM). After model training, normal and abnormal behaviors are distinguished by threshold U = 0.5, where U is determined based on cross-validation to maximize the harmonic mean of precision and recall (F1 score).

[0154] The details are shown in the following table:

[0155] Table 1 Experimental record table

[0156]

[0157]

[0158] By analyzing the above data, we can observe that:

[0159] The comprehensive security score SS of users User1 and User3 is significantly higher than that of other users, thanks to the lower login anomaly index LEI and operation anomaly index OEI, indicating that our model can effectively identify and give higher weight to normal behavior, reflecting the accuracy of the model in identifying normal and abnormal behaviors.

[0160] By comparing the data of User2 and User1, although the two are similar in activity index AI and operation index RI, User2's overall security score is lower due to its higher LEI value. This shows that the weight adaptive adjustment mechanism can dynamically adjust parameters according to the subtle differences in different user behaviors, effectively improving the pertinence and accuracy of security protection.

[0161] Based on the comprehensive security score CS, the users in the embodiment are automatically classified into different security levels, and then corresponding measures are taken. For example, for users with low security levels (such as extreme cases not shown in the simulation), strict access control is implemented to effectively reduce the potential threat risks. For users with high security levels, an optimized network experience is provided to ensure business smoothness, reflecting the flexibility and practicality of the invention content in practical applications.

[0162] This embodiment not only verifies the technical feasibility of the invention, but also highlights its innovation and advantages in improving network security protection efficiency and user experience through specific data. Through further experiments and optimization, this method is expected to become an important technological breakthrough in the field of network security protection in the future.

[0163] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security protection method, characterized in that: include, Obtain user behavior data of target users and determine the user's current network security level; Automatically adjust the weight parameters of the activity index, login abnormality index, operation index, and operation abnormality index based on the real-time status and historical data of the network environment; Use the collected user behavior data to build a mixed state model to identify and predict normal and abnormal behavior patterns; Based on the dynamically adjusted weight parameters, the comprehensive security parameters of the target user are calculated to determine the user's overall security level; Dynamically adjust network access control policies based on the user's overall security level; The user behavior data includes the activity index AI, login abnormality index LEI, operation index RI and operation abnormality index OEI; Determining the current network security level of the user includes the following steps: a comprehensive security score is performed based on the activity index AI, the login anomaly index LEI, the operation index RI, and the operation anomaly index OEI. The expression is: Among them, SS represents the comprehensive safety score, ∫ represents the integral symbol, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor, ω AI (t),ω LEI (t),ω RI (t),ω OEI (t) represents the dynamic weights of AI, LEI, RI and OEI. AI(t), LEI(t), RI(t) and OEI(t) represent the values ​​of activity index, login abnormality index, operation index and operation abnormality index at time t respectively. dt represents the weighted accumulation of all instantaneous behaviors from time 0 to T. The comprehensive security score SS divides users into different preliminary security levels; The specific steps of automatically adjusting the weight parameters of the activity index, login abnormality index, operation index and operation abnormality index according to the real-time status and historical data of the network environment are as follows: Collect the real-time status of the network environment; Analyze historical data to provide a basis for automatically adjusting weight parameters; The real-time status data and historical data are combined into a set of feature vectors, expressed as: Among them, X t represents the feature vector, n represents the number of features, and t represents the time point; Define the loss function as L(ω, X t ); At each time step t, based on the feature vector X t and the weight vector ω at the previous time step t-1 t-1 , the online gradient descent OGD algorithm is used to adjust the weight parameter ω in real time t , the expression is: Among them, ω t represents the weight vector at time t, ω t-1 represents the weight vector at the previous time step t-1, η represents the learning rate, Denotes the loss function L with respect to the weight vector ω t-1 In the current feature vector X t The gradient vector under .

2. The network security protection method according to claim 1, characterized in that: The method uses the collected user behavior data to train the mixed state model to identify and predict normal and abnormal behavior patterns. The specific steps are as follows: Construct a hybrid state model that integrates the feature representation H(t) of LSTM and CNN and the state transition information of the hidden Markov model HMM. t For feature extraction and pattern learning, the expression is: y(t)=Softmax(W2·ReLU(W1·[X t ;H(t)]+b1)+W3·MaxProbTrans[α t ]+b2) Among them, y(t) represents the probability value predicted at time step t, Softmax and ReLU are activation functions, H(t) represents the current hidden state, W1 and W2 are the weight matrices of the first and second layers respectively, W3 represents the third weight matrix, which is used to map the state transfer information to the output layer, b1 and b2 are the bias items of the first and second layers respectively, MaxProbTrans represents the maximum probability value in the state transfer matrix, α t Represents the state probability distribution of the current time step; Set a threshold U and compare the predicted value y(t) with the threshold U; When y(t)>U, it is judged as normal behavior; When y(t)≤U, it is judged as abnormal behavior.

3. The network security protection method according to claim 2, characterized in that: The comprehensive security parameters of the target user are calculated based on the dynamically adjusted weight parameters, thereby determining the overall security level of the user. The specific steps are as follows: Based on the adjusted weight parameter ω=[ω AI ,ω LEI ,ω RI ,ω OEI ], calculate the first reliability value and the second reliability value; The first reliability value is expressed as: Among them, R1 represents the first reliable value, ω i (t) represents the weight of indicator i at time t, X i (t) represents the value of indicator i at time t, γ is a constant coefficient, i≠j represents the pairing between indicators i and j, ω ij (t) represents the interaction weight of indicators i and j at time t, Z represents the normalization factor, and X j (t) represents the value of index j at time t, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor; The second reliability value is expressed as: Where R2 represents the second reliable value, y(t) represents the predicted probability value of the mixed state model at time t, α and β are the weight coefficients of the weighted average of the prediction model output and the behavior index, J represents the standard deviation, Var[y(t)] and μ[y(t)] represent the variance and mean of the predicted value y(t) over time, T represents the time range of data collection, λ represents the decay rate, and e -λt represents the exponential decay factor; Based on R1 and R2, a composite index is defined to determine the user's overall security level, expressed as: CS = £·R1+(1-£)·R2 Among them, CS represents the comprehensive safety score and ￡ represents the weight factor.

4. The network security protection method according to claim 3, characterized in that: The specific steps of dynamically adjusting the network access control policy according to the user's overall security level are as follows: Based on the user's comprehensive security score CS, the corresponding policy set is automatically selected and applied, and the policy selection function is constructed. The expression is: P(CS)={LSL, if CS≤θ1MSL, if θ1<CS≤θ2HSL, if CS>θ2} Among them, P(CS) represents the policy selection function, LSL, MSL, and HSL represent the policy sets of low, medium, and high security levels, respectively, if means if, and θ1 and θ2 are the thresholds of the comprehensive security score CS.

5. The network security protection method according to claim 4, characterized in that: The specific steps of dynamically adjusting the network access control strategy are as follows: Set thresholds θ1 and θ2 according to the comprehensive safety score CS; When CS≤θ1, the user is judged to have a low security level, and a one-time SMS verification code is sent to the registered mobile phone number to verify the identity. The user needs to enter the verification code within the specified time to pass the verification. After passing the verification, access to sensitive resources and key systems is restricted, and only necessary services are open to reduce network resource allocation. Failure to enter the verification code within the specified time is considered a verification failure and the user is denied access; When θ1<CS≤θ2, the user is judged to be at a medium security level, and a one-time SMS verification code is sent to the registered mobile phone number to verify the identity. The user needs to enter the verification code within the specified time to pass the verification. After passing the verification, system resources and function access are limited according to the user role. The access log is reviewed regularly and suspicious behavior is warned. Failure to enter the verification code within the specified time is considered a verification failure and the user is denied access; When CS>θ2, the user is judged to be at a high security level and needs to enter a preset six-digit password to pass the verification. After successful verification, full access rights are enabled, and the user can freely access resources according to work needs, and network resources are allocated preferentially to ensure business smoothness.

6. A network security protection system, based on the network security protection method according to any one of claims 1 to 5, characterized in that: Including, acquisition module, adjustment module, analysis module, evaluation module and execution module; The acquisition module is responsible for collecting the user behavior data of the target user in real time, collecting the real-time status data and historical data of the network environment, and at the same time, it is also responsible for normalizing the collected data; The adjustment module includes automatically adjusting the weight parameters of the activity index, login abnormality index, operation index and operation abnormality index based on the collected real-time network environment status and historical data analysis; The analysis module includes using a hybrid state model to conduct in-depth analysis of user behavior data to achieve identification and prediction of normal and abnormal behavior patterns. By training the model, setting thresholds to determine whether the behavior is normal or not, and providing users with immediate security risk feedback; The evaluation module includes comprehensively considering the user behavior indicators and behavior pattern prediction results after weight adjustment, and further determining the user's overall security level by calculating the comprehensive security score CS of the target user; The execution module includes dynamically adjusting the network access control strategy according to the user's comprehensive security score. At the same time, the system continuously monitors the changes in the user's security level to ensure timely adjustment and implementation of the strategy.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security protection method described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security protection method described in any one of claims 1 to 5 are implemented.

Images