A computer network information security analysis method and system based on big data

Abstract

The present invention relates to the field of big data network information security analysis, specifically a computer network information security analysis method and system based on big data, the method obtains operation data and adds data tags to record as first data and obtains second data according to data tag classification; extracts operation data through features to obtain operation feature data and obtains analysis results through a security analysis model; stores data securely according to risk types; when operation data is determined to be abnormal data, calculates correlation coefficients between abnormal data and risk types through correlation, and when the correlation coefficient is greater than a preset correlation threshold, records it as a risk factor, and takes suppression operations on risk factors according to predicted occurrence time; and generates early warning information for the first data corresponding to the risk factor. Effectively improve the security and efficient and stable operation of enterprise network office systems.

Description

Technical Field

[0001] The present invention relates to the field of big data network information security analysis, and specifically to a computer network information security analysis method and system based on big data. Background Art

[0002] In the current digital age, the security of enterprise network office systems, as an important platform for internal information flow and collaborative office work, is directly related to the operational efficiency and security of data assets of the enterprise. In addition, more and more enterprises choose to migrate data storage and computing tasks to the cloud.

[0003] However, even cloud storage will affect the operation of the network, and there is no effective solution to the problem of slow network operation. In order to balance the problem of cloud servers, many companies will regularly clean up the operation data. However, with the sharp increase in the amount of data, the subsequent data cleaning is time-consuming and laborious. In addition, once a risk event occurs, the data may be lost in large quantities due to untimely emergency response. Regardless of whether it is important or not, it will pose a serious threat to the operation of the enterprise. Therefore, there is an urgent need for a computer network information security analysis method to effectively improve the operation data security and efficient and stable operation of the enterprise network office system. Summary of the invention

[0004] (1) Technical issues to be resolved

[0005] The purpose of the present invention is to provide a computer network information security analysis method and system based on big data, so as to solve the problem that enterprises encounter risks such as data loss and web page freezes on network office systems and cannot deal with them in a timely and effective manner, posing a serious threat to the production and operation of enterprises.

[0006] (2) Technical solution

[0007] To achieve the above objectives, on the one hand, the present invention provides a computer network information security analysis method based on big data, the method comprising:

[0008] S1. Obtaining operation data in the system, adding data tags through a data tagging method and recording them as first data, and classifying the first data according to the data tags to obtain second data; the operation data includes master data and knowledge base data;

[0009] S2, preprocessing the operation data and obtaining operation feature data through feature extraction, and performing risk prediction on the operation feature data through a safety analysis model to obtain analysis results; the analysis results include risk type and risk prediction occurrence time; when a risk occurs in the monitoring system, the risk data is entered into a risk analysis database and the safety analysis model is updated;

[0010] S3, storing the second data securely according to the risk type; by monitoring the operating data in the system, when the operating data is determined to be abnormal data, calculating the correlation coefficient between the abnormal data and the risk type through correlation calculation, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor, and a suppression operation is taken on the risk factor according to the predicted occurrence time; the suppression operation is to postpone execution or prohibit execution;

[0011] S4. Obtain the corresponding first data of the risk factor according to the data tag and generate warning information, and send the warning information to the operation end and the management end; if it is detected that the operation end does not operate within the safe time period before the risk prediction occurs, the management end will obtain the operation authority and perform safe operations.

[0012] Furthermore, when the operating data in the monitoring system is determined to be abnormal data, the abnormal data and the risk type are correlated to obtain a correlation coefficient, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor. The method of suppressing the risk factor according to the predicted occurrence time includes:

[0013] Obtain the system's historical risk events and operating data before the risk events occur, the operating data before the risk events occur including data storage space, data operation volume, client operation volume, and module operation volume; identify the operating data that triggers the risk event through a data analysis method when the risk event occurs and record it as abnormal data;

[0014] The system operation data and abnormal data are analyzed for correlation to obtain a correlation degree. When the correlation degree is greater than a preset risk correlation threshold, the operation data is determined to be abnormal data.

[0015] Obtaining historical risk factors of the risk type, obtaining a correlation coefficient between the abnormal data and the historical risk factors through a correlation analysis method, and recording the abnormal data as a risk factor when the correlation coefficient is greater than a preset correlation threshold;

[0016] The risk factor is used to find abnormal operation terminals through a network topology diagram, and the operation data of the abnormal operation terminals is obtained, and a data proportion analysis is performed to obtain a ranking result. According to the ranking result, the operation terminals with a high data proportion are preferentially suppressed. The suppression operation is evaluated by a risk suppression effect evaluation method to obtain an evaluation value. When the evaluation value is less than a preset risk assessment threshold, the suppression operation is performed. When the evaluation value is greater than the preset risk assessment threshold, a warning message is issued.

[0017] Furthermore, it is characterized in that the method of obtaining an evaluation value of the suppression operation through a risk suppression effect evaluation method comprises:

[0018] The risk factor set for obtaining risk type is recorded as By adjusting the risk factors The inhibitory strength Get the inhibition efficiency, risk factor The inhibition efficiency function The calculation formula is:

[0019] ;

[0020] in, is a preset parameter for controlling the degree of nonlinearity; ; , is the attenuation coefficient, is the preset initial suppression strength;

[0021] By suppressing the efficiency function Risk Factors After suppression, the risk contribution is obtained. The calculation formula is:

[0022] ;

[0023] in, To consider the function of risk contribution decaying over time, is the preset risk contribution attenuation constant; represents the initial risk contribution, which is obtained through statistical analysis of historical data;

[0024] The risk factor set The risk contribution of is evaluated by the risk suppression effect evaluation method to obtain an evaluation value, and the evaluation value The calculation formula is:

[0025] ;

[0026] in, is the risk accumulation function, is the preset risk attenuation rate; Risk Factor The weight of the association with the risk type.

[0027] Furthermore, it is characterized in that the method of finding abnormal operation terminals by using the risk factors through a network topology diagram comprises:

[0028] Generate a network topology map by drawing, the network topology map includes a logical topology map and a physical topology map; monitor risk factors in real time through an integrated monitoring method of the network topology map;

[0029] When a risk factor is detected, the abnormal operation end is located in the network topology map through an automatic association method; a risk tag is added to the abnormal operation end according to the risk type, and the risk level of the abnormal operation end is adjusted according to the tag attribute and the number of risk tags. When the risk level of the abnormal operation end is greater than the preset safety threshold, the abnormal operation end is listed for key monitoring;

[0030] When the frequency of receiving warning information of the monitored abnormal operation terminal is greater than the preset safety frequency, the abnormal operation terminal is included in the risk list and risk processing is performed.

[0031] Furthermore, it is characterized in that the method for securely storing the second data according to the risk type comprises:

[0032] Extracting the second data by data feature to obtain feature data, obtaining the importance value, confidentiality level, and urgency value of the second data according to the feature data, and obtaining a comprehensive score value by a linear weighted algorithm; securely storing the second data in descending order of the comprehensive score values; the secure storage is to complete the data storage before the risk prediction occurs;

[0033] When the frequency of occurrence of the monitored risk type is greater than the preset safety frequency, and the analysis curve obtained through statistical analysis of the frequency of occurrence of the risk type shows an increasing trend, the second data is safely stored according to the comprehensive score value and an early warning message is issued;

[0034] When an abnormal surge occurs in the amount of monitored operation data, and the abnormal surge is greater than a preset safety surge, the data backup frequency and compression method are adjusted according to the abnormal surge; the preset safety surge is the minimum surge that triggers risks based on statistical historical risk events.

[0035] Furthermore, it is characterized in that when the risk factor is monitored, the method of locating the abnormal operation end in the network topology diagram by the automatic association method includes:

[0036] Obtain historical risk factors, build an association rule library between risk factors and abnormal operation ends based on the network topology map, match the risk factors monitored in real time with the association rule library and identify risk factor combinations that meet specific rules, and locate the abnormal operation end in the network topology map based on the risk factor combination.

[0037] Furthermore, it is characterized in that the method of performing risk prediction on the operation characteristic data through a safety analysis model to obtain an analysis result comprises:

[0038] Acquire the historical operation data of the system, preprocess the historical operation data and obtain operation safety feature data through feature extraction; the historical operation data includes log data, traffic data, and behavior data; establish a mapping relationship between the operation safety feature data and the analysis results through a neural network algorithm to obtain a security analysis model.

[0039] Based on the same inventive concept, the present invention also provides a computer network information security analysis system based on big data, the system comprising: a data processing module, a risk analysis module, a data management module, and a risk management module, and each module is sequentially connected in communication;

[0040] A data processing module, used to obtain operation data in the system and add data tags through a data tagging method and record them as first data, and classify the first data according to the data tags to obtain second data; the operation data includes master data and knowledge base data;

[0041] The risk analysis module is used to pre-process the operation data and obtain operation feature data through feature extraction, and to perform risk prediction on the operation feature data through a safety analysis model to obtain an analysis result; the analysis result includes the risk type and the predicted risk occurrence time; when a risk occurs in the monitoring system, the risk data is entered into the risk analysis database and the safety analysis model is updated;

[0042] A data management module is used to safely store the second data according to the risk type; by monitoring the operation data in the system, when the operation data is determined to be abnormal data, the abnormal data and the risk type are correlated to obtain a correlation coefficient, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor, and a suppression operation is taken on the risk factor according to the predicted occurrence time; the suppression operation is to postpone execution or prohibit execution;

[0043] The risk management module is used to obtain the corresponding first data according to the data tag of the risk factor and generate warning information, and send the warning information to the operation end and the management end; if it is detected that the operation end has not performed any operation within the safe time period before the risk prediction occurs, the management end will obtain the operation authority and perform safe operations.

[0044] (3) Beneficial effects

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. When risk factors are detected, the abnormal operation end can be quickly located through the network topology map, and key monitoring or risk treatment can be carried out according to the degree of risk, which helps to timely discover and eliminate potential safety hazards.

[0047] 2. Through the risk suppression effect evaluation model, the effect of the suppression operation is quantitatively evaluated to ensure the rationality and effectiveness of the suppression operation, further improving the overall safety and operation efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flowchart of a computer network information security analysis method based on big data according to Embodiment 1 of the present invention;

[0049] Figure 2 This is a schematic diagram of the module composition of a computer network information security analysis system based on big data according to Example 2 of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Before giving examples, it is necessary to explain the application scenarios conceived by the present invention. The present invention is a computer network information security analysis method and system based on big data. The use of network office systems is becoming more and more popular in today's enterprises, and network office systems can help enterprises operate more efficiently. However, there are many problems in the use of network office systems, especially when some enterprises are unable to further improve the configuration of the network office system and cannot guarantee the safe and stable operation of the network office system, which will cause frequent failures in the network office system and seriously affect the normal operation of the enterprise. Therefore, there is an urgent need for a computer network security analysis method based on big data, which can comprehensively analyze the operation of the network office system, effectively predict failures, analyze the causes of failures, and improve the safe operation of the network office system.

[0052] Example 1: Figure 1 As shown, this embodiment provides a computer network information security analysis method based on big data, the method comprising:

[0053] S1. Obtain the operating data in the system and add data tags through the data tagging method and record them as the first data. Classify the first data according to the data tags to obtain the second data; the operating data includes master data and knowledge base data; the data tags are the initiator, circulator, data title, data content, data urgency, etc. of the operating data, and the master data includes system performance indicators (memory usage, network traffic), number of emails, process data, number of communications, etc. The knowledge base mainly includes documents, systems, learning information, etc. The marked first data is classified according to the data tags to obtain the second data, so as to organize the data into a more organized form that is easier to analyze and use.

[0054] S2. Preprocess the operation data and extract the operation feature data through features, and use the safety analysis model to predict the risk of the operation feature data to obtain the analysis results; the analysis results include the risk type and the predicted time of risk; when the monitoring system has a risk, the risk data is entered into the risk analysis database and the safety analysis model is updated; the operation status of the system is monitored in real time and compared with the risk prediction results, and when the system has the predicted risk, the corresponding emergency response mechanism is immediately triggered. The actual risk data (including risk type, occurrence time, impact range, etc.) is entered into the risk analysis database, and the safety analysis model is updated and optimized to improve the prediction accuracy and generalization ability, including retraining the model, adjusting model parameters, introducing new features, etc.

[0055] S3. Safely store the second data according to the risk type; by monitoring the operating data in the system, when the operating data is determined to be abnormal data, calculate the correlation coefficient between the abnormal data and the risk type through correlation calculation, and when the correlation coefficient is greater than the preset correlation threshold, it is recorded as a risk factor, and the risk factor is inhibited according to the predicted occurrence time; the inhibition operation is to postpone execution or prohibit execution; according to the risk type predicted by the security analysis model, such as data loss, service interruption, network delay, etc., divide the second data into different security levels, and formulate corresponding storage strategies for each security level. For high-risk data, encrypted storage and databases or cloud storage services with stricter access control are required. Monitor abnormal behavior or data patterns through real-time monitoring tools or log analysis systems, set abnormal data detection methods, and determine the operating data as abnormal data when they meet these rules. Calculate the correlation between abnormal data and risk type, and calculate the correlation coefficient through a correlation algorithm, such as using Pearson correlation coefficient, cosine similarity, etc., by considering the similarity between the feature vector of abnormal data and the feature vector of risk type. When the correlation coefficient between a certain abnormal data and a risk type is greater than the preset correlation threshold, the abnormal data is determined to be a risk factor of the risk type. According to the risk occurrence time predicted by the security analysis model, the urgency and potential impact of the risk factor are evaluated, and the suppression operation is decided based on the predicted occurrence time and the nature of the risk factor. For non-urgent operations that may cause risks, they can be scheduled for execution in a time period with lower risks. For high-risk operations, if the assessment believes that their execution will directly lead to the occurrence of risks, their execution should be prohibited immediately. Suppression operations are implemented through system control mechanisms to ensure that risk factors are effectively controlled.

[0056] S4. Obtain the corresponding first data according to the data tag of the risk factor and generate warning information, and send the warning information to the operation end and the management end; if the operation end is detected to have not performed operations within the safe time period before the risk prediction time, the management end will obtain the operation authority and perform the safety operation. When the risk factor is identified, the system will trace back to the corresponding first data according to the data tag to which the risk factor belongs, and integrate the risk factor with the relevant first data to provide a complete data context for the subsequent generation of warning information. Generate detailed warning information based on the integrated first data and the nature of the risk factor. The warning information should include the risk type, risk level, predicted occurrence time, possible impact range, and recommended countermeasures. Send the warning information to the operation end and the management end through the system preset method, such as SMS, system notification, etc., so as to ensure that relevant personnel can receive and understand the risk situation in time. After receiving the warning information, the operation end should take action as soon as possible according to the recommended countermeasures, including performing safety operations and safety inspections, contacting technical support, etc. The system continuously monitors whether the operation end has performed necessary operations before the risk prediction time, which is achieved through log records, system monitoring or automated scripts. If the system detects that the operator has not performed any operation within the safe time period before the predicted risk occurs or the operation is not sufficient to eliminate the risk, the management end will automatically obtain the operation authority and perform necessary security operations, including takeover, risk blocking, isolation of affected system components, etc. The safe time period before the predicted risk occurs is a time period divided according to the time proportion of the operator and management end to handle the risk.

[0057] Furthermore, when the operating data in the monitoring system is determined to be abnormal data, the abnormal data and the risk type are correlated to obtain a correlation coefficient, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor. The method of suppressing the risk factor according to the predicted occurrence time includes:

[0058] Obtain the system's historical risk events and operating data before the risk event occurs. The operating data before the risk event occurs includes data storage space, data operation volume, client operation volume, and module operation volume; identify the operating data that triggers the risk event through data analysis methods and record it as abnormal data; collect all known historical risk event data from the system's log records, event management system or database. These data should include key information such as the type of risk event, time of occurrence, scope of impact, and solution, and screen out risk events of a specific type or time period as research objects. Clarify the scope of operating data that needs to be collected before the risk event occurs, including but not limited to data storage space, data operation volume, client operation volume, module operation volume, etc., and use system monitoring tools, log analysis software or directly extract these data from the system database. Based on the data change trend before and after the risk event occurs, use numerical analysis methods to infer the operating data when the risk event occurs. Apply statistical models to analyze the operating data before the risk event occurs, and identify data points that are significantly different from normal conditions as abnormal data. These abnormal data are the key factors that trigger risk events.

[0059] The system's operating data and abnormal data are analyzed to obtain the degree of association. When the degree of association is greater than the preset risk association threshold, the operating data is determined to be abnormal data. According to the rules of association analysis, a suitable association analysis algorithm is selected to mine frequent item sets and association rules in the data and calculate the degree of association. The degree of association reflects the closeness or dependency between data items in the rules. A reasonable risk association threshold is set based on the system's historical risk events and data analysis results. This threshold is used to distinguish normal data associations from abnormal associations that may cause risks, and the degree of association is compared with the preset risk association threshold. If the degree of association is greater than the preset risk association threshold, the operating data is abnormal.

[0060] Obtain the historical risk factors of the risk type, and obtain the correlation coefficient between the abnormal data and the historical risk factors through the correlation analysis method. When the correlation coefficient is greater than the preset correlation threshold, the abnormal data is recorded as a risk factor; by obtaining the historical risk factors that lead to the risk type, these historical risk factors can be obtained through statistical analysis methods. Organize the abnormal data into the same feature dimensions as the risk factors, extract the key indicators or attributes in the abnormal data and convert them into numerical form, and use the normalized Euclidean distance to calculate the correlation, and then convert it into a correlation coefficient. Calculate the Euclidean distance between the abnormal data and each risk factor, and then select a threshold to distinguish between "similar" and "dissimilar". Set a preset correlation threshold to distinguish between abnormal data with significant correlation and those that are only accidentally similar. When the correlation coefficient between the abnormal data and the risk factor is greater than the preset correlation threshold, the abnormal data is a risk factor that may cause the risk type to occur.

[0061] The risk factor is used to find abnormal operation terminals through the network topology map, and the operation data of the abnormal operation terminals is obtained and the data proportion analysis is performed to obtain the sorting results. According to the sorting results, the operation terminals with high data proportion are preferentially suppressed; the suppression operation is evaluated by the risk suppression effect evaluation method. When the evaluation value is less than the preset risk assessment threshold, the suppression operation is performed, and when the evaluation value is greater than the preset risk assessment threshold, an early warning message is issued. According to the network structure and connection relationship of the system, a detailed network topology map is constructed, including all servers, clients, network devices and the connections between them. In the network topology map, the areas or nodes that may be affected are located according to the known risk factors, and the operation terminals that show abnormal behavior are identified by monitoring and analyzing the traffic, request mode, response time and other indicators of these affected areas or nodes. Key operation data such as CPU usage, memory usage, data changes, etc. are collected from abnormal operation terminals. The collected data is analyzed for proportion, and the proportion of each operation terminal in different resources or performance indicators is calculated to identify which operation terminals have abnormally high resource consumption or request frequency. According to the analysis results of the proportion of these abnormal data, the abnormal operation terminals are sorted. The basis for sorting can be the proportion of a single indicator or the comprehensive score of multiple indicators. Based on the sorting results, the operation end with a high proportion of data is given priority for suppression operations. These strategies may include limiting network bandwidth, limiting the use of CPU and memory resources, suspending services or requests, etc. Build a model to evaluate the effect of the suppression operation, and calculate the evaluation value to reflect the actual effect of the suppression operation. Compare the evaluation value with the preset risk assessment threshold. If the evaluation value is less than the threshold, it means that the suppression operation is effective, and it can continue to be executed or further optimization can be considered; if the evaluation value is greater than the threshold, it means that the suppression operation has not achieved the expected effect, and a warning message needs to be issued.

[0062] Furthermore, the method of obtaining an evaluation value of the suppression operation through a risk suppression effect evaluation method includes:

[0063] The risk factor set for obtaining risk type is recorded as By adjusting the risk factors The inhibitory strength Get the inhibition efficiency, risk factor The inhibition efficiency function The calculation formula is:

[0064] ;

[0065] in, is a preset parameter for controlling the degree of nonlinearity; ; , is the attenuation coefficient, is the preset initial suppression strength;

[0066] By suppressing the efficiency function Risk Factors After suppression, the risk contribution is obtained. The calculation formula is:

[0067] ;

[0068] in, To consider the function of risk contribution decaying over time, is the preset risk contribution attenuation constant; represents the initial risk contribution, which is obtained through statistical analysis of historical data;

[0069] The risk factor set The risk contribution of is evaluated by the risk suppression effect evaluation method to obtain an evaluation value, and the evaluation value The calculation formula is:

[0070] ;

[0071] in, is the risk accumulation function, is the preset risk attenuation rate; Risk Factor The association weight between the risk type. is the risk accumulation function expressed in time How do risk events affect the That is, represents the time interval from the event occurrence time s to the current time t, if If it increases or remains positive for a long time, it means that the risk increases over time. If it decays rapidly to zero, it means that the impact of the risk event weakens rapidly over time.

[0072] Furthermore, the method of finding abnormal operation terminals by using the risk factors through a network topology diagram includes:

[0073] Generate a network topology map by drawing, the network topology map includes a logical topology map and a physical topology map; monitor risk factors in real time through an integrated monitoring method of the network topology map;

[0074] When a risk factor is detected, the abnormal operation end is located in the network topology map through an automatic association method; a risk tag is added to the abnormal operation end according to the risk type, and the risk level of the abnormal operation end is adjusted according to the tag attribute and the number of risk tags. When the risk level of the abnormal operation end is greater than the preset safety threshold, the abnormal operation end is listed for key monitoring;

[0075] When the frequency of receiving warning information from the abnormal operation terminal is greater than the preset safety frequency, the abnormal operation terminal will be included in the risk list and risk processing will be performed.

[0076] Collect detailed information about all devices in the network, including device type (such as routers, switches, servers, workstations, etc.), IP address, physical location, connection interface, etc. Use professional network drawing tools to draw, such as Visio, Lucidchart, OmniGraffle, etc. The logical topology diagram shows the logical relationship and data flow between the components within the system, including the connection and interaction between servers, databases, applications, middleware, etc. The physical topology diagram shows the connection relationship between the actual physical devices of the system, such as switches, routers, server racks, cable layouts, etc. Integrate monitoring tools in the network topology diagram to monitor key data such as network traffic, device status, performance indicators, etc. in real time. Configure monitoring rules to trigger alerts when abnormal behavior or specific risk factors are detected. When the monitoring tool detects a risk factor, the correlation between the risk factor and each operation end is analyzed in the network topology diagram through an automatic correlation algorithm. Based on the results of the correlation analysis, locate the specific abnormal operation end in the topology diagram. Add a risk tag to each abnormal operation end, and the tag should clearly identify the risk type (such as DDoS attack, SQL injection, etc.). Dynamically adjust its risk level based on the attributes of the tag and the number of risk tags. Set a preset safety threshold. When the risk level of an abnormal operation terminal exceeds this threshold, it will be listed as a key monitoring target. Carry out more stringent monitoring of the abnormal operation terminals listed as key monitoring, including increasing the monitoring frequency, expanding the monitoring scope, etc. When it is detected that the frequency of abnormal operation terminals receiving warning information is greater than the preset safety frequency, it is considered that the operation terminal has a persistent or serious risk problem. Abnormal operation terminals that frequently receive warning information will be included in the risk list, and emergency notifications will be issued to relevant personnel to implement risk handling measures, such as isolating the affected operation terminals, blocking malicious traffic, and upgrading security patches.

[0077] Furthermore, the method for securely storing the second data according to the risk type includes:

[0078] Extract the second data by data feature to obtain feature data, obtain the importance value, confidentiality level, and urgency value of the second data according to the feature data, and obtain a comprehensive score value through a linear weighted algorithm; safely store the second data in descending order of the comprehensive score value; the safe storage is to complete the data storage before the risk prediction occurs; extract key features from the second data using data mining or machine learning technology. The importance value evaluates the importance of the second data to the organization or business process according to the feature data, and can be obtained through expert scoring, historical data analysis, or machine learning model prediction. The confidentiality level is determined according to the sensitivity of the data, legal requirements, or organizational policies. For example, personal identity information may have a higher confidentiality level. The urgency value evaluates the priority of the data in an emergency, which is usually related to the timeliness and business dependency of the data. Set weights for the importance value, confidentiality level, and urgency value respectively. The weight setting should be based on specific needs and strategies, and is usually obtained through expert consultation or data analysis. Use a linear weighted algorithm to multiply the score of each attribute by its corresponding weight and sum them to obtain a comprehensive score value of the second data. According to the comprehensive score value, the data is stored on a storage medium with a corresponding security level. For example, high-scoring data may be stored on encrypted, physically isolated storage devices to ensure that data storage is completed before the risk prediction occurs, involving real-time data processing, priority storage queues, or automatic backup strategies. For high-scoring data, more frequent backups and redundant storage are implemented to improve data availability and recovery capabilities.

[0079] When the frequency of occurrence of the monitored risk type is greater than the preset safety frequency, and the analysis curve obtained after statistical analysis of the frequency of occurrence of the risk type shows an increasing trend, the second data is securely stored according to the comprehensive score value and an early warning message is issued; the frequency of occurrence of various risk types in the system is monitored in real time or regularly, and is achieved through log analysis, network traffic monitoring, security event management (SIEM) system and other methods. The monitored frequency of occurrence of the risk type is compared with the preset safety frequency, and the preset safety frequency is a threshold set according to the full strategy, historical data and expert advice. If the frequency of occurrence of the risk type is greater than the preset safety frequency, the frequency of occurrence of the risk type is further statistically analyzed, including calculating statistical indicators such as the average value, standard deviation, and trend line. According to the results of the statistical analysis, it is judged whether the analysis curve of the frequency of occurrence of the risk type shows an increasing trend, which can be achieved by observing the slope of the trend line, using time series analysis techniques (such as ARIMA model, exponential smoothing method, etc.) or simple trend judgment rules. If the frequency of occurrence of the risk type is greater than the preset safety frequency and the analysis curve shows an increasing trend, it is securely stored according to the comprehensive score value of the second data. Early warning information should include detailed information on the risk type, frequency of occurrence, growth trend, affected data range, and recommended response measures, which will help to respond to risk events in a timely manner and reduce potential losses.

[0080] When the data volume of the monitored operating data shows an abnormal surge, and the abnormal surge is greater than the preset safety surge, the data backup frequency and compression method are adjusted according to the abnormal surge; the preset safety surge is based on the minimum surge that triggers the risk in the statistical historical risk events. When the monitored operating data shows an abnormal surge, in order to ensure the integrity and availability of the data and control the storage cost and efficiency, the data backup frequency and compression method can be adjusted according to the abnormal surge. Real-time or regular monitoring of the data volume of the operating data in the system involves monitoring the database, file system or data traffic, and obtaining a real-time snapshot or historical trend of the current data volume. Compare the current data volume with the data volume under normal circumstances (such as historical averages, daily / weekly / monthly trend lines, etc.) to identify whether there is an abnormal surge. The abnormal surge may be manifested as a sudden surge in the data volume, far exceeding the normal fluctuation range, and the identified abnormal surge is compared with the preset safety surge. The preset safety surge is set based on the minimum surge that triggers the risk in the statistical historical accidents. If the abnormal surge is greater than the preset safety surge, the frequency of data backup is first considered to ensure that the data can still be recovered and intact in the case of rapid data growth. The increase in backup frequency should be adjusted flexibly according to the actual situation to avoid excessive impact on system performance. At the same time, consider adjusting the data compression method to optimize storage efficiency. In the case of a surge in data volume, using a more efficient compression algorithm can reduce the demand for storage space and may also reduce the time cost during backup and recovery. The choice of compression method should comprehensively consider factors such as compression ratio, compression speed, and decompression speed.

[0081] Furthermore, when a risk factor is detected, the method of locating an abnormal operation terminal in a network topology diagram by an automatic association method includes:

[0082] Obtain historical risk factors, build an association rule base between risk factors and abnormal operation terminals based on the network topology map, match the risk factors monitored in real time with the association rule base and identify the risk factor combination that meets the specific rules, and locate the abnormal operation terminal in the network topology map based on the risk factor combination. Based on the structure and logic of the network topology map, define the association rules between risk factors and abnormal operation terminals, and the association rules can reflect the propagation path, impact range and potential connection between risk factors and abnormal operation terminals in the network. Organize the defined association rules into a rule base, which should support efficient query and matching operations so as to quickly identify qualified risk factor combinations during real-time monitoring. Use network monitoring tools and systems to match the risk factors monitored in real time with the rules in the association rule base, which can be achieved through pattern recognition, logical judgment or machine learning algorithms. In the matching process, a risk factor combination that meets the specific rules is identified through combination analysis, and the risk factor combination represents a known attack mode, malicious behavior or potential security threat. Based on the characteristics of the risk factor combination and historical experience, the degree and urgency of the harm it may cause to the network are evaluated, and then the structural information of the network topology map is used to analyze the propagation path and impact range of the risk factor combination in the network, so as to locate the abnormal operation end associated with the risk factor combination in the network topology map.

[0083] Furthermore, the method of performing risk prediction on the operation characteristic data through a safety analysis model to obtain an analysis result includes:

[0084] Obtain the historical operation data of the system, pre-process the historical operation data and obtain the operation security feature data through feature extraction; the historical operation data includes log data, traffic data, and behavior data; establish a mapping relationship between the operation security feature data and the analysis results through a neural network algorithm to obtain a security analysis model. Extract features such as timestamp, event type, event description, error code, etc. from the log data. Calculate the statistical features of traffic data, such as total traffic, average traffic, peak traffic, data packet size distribution, etc. Analyze user and system behavior patterns, and extract features such as login frequency, operation sequence, and abnormal behavior patterns. Build a model structure through a convolutional neural network (CNN), use the extracted operation security feature data as input, and use known security events or states as output to train the neural network model. Evaluate the performance of the model through methods such as cross-validation, and adjust the model structure and parameters as needed to optimize the performance. During the training process, the neural network automatically learns the complex mapping relationship between the operation security feature data and the security analysis results. This mapping relationship can capture hidden patterns and laws in the data, thereby realizing the prediction or classification of unknown data.

[0085] Embodiment 2: Based on the same inventive concept, this embodiment also provides a computer network information security analysis system based on big data, including: a data processing module, a risk analysis module, a data management module, and a risk management module, and each module is sequentially connected in communication;

[0086] A data processing module, used to obtain operation data in the system and add data tags through a data tagging method and record them as first data, and classify the first data according to the data tags to obtain second data; the operation data includes master data and knowledge base data;

[0087] The risk analysis module is used to pre-process the operation data and obtain operation feature data through feature extraction, and to perform risk prediction on the operation feature data through a safety analysis model to obtain an analysis result; the analysis result includes the risk type and the predicted risk occurrence time; when a risk occurs in the monitoring system, the risk data is entered into the risk analysis database and the safety analysis model is updated;

[0088] A data management module is used to safely store the second data according to the risk type; by monitoring the operation data in the system, when the operation data is determined to be abnormal data, the abnormal data and the risk type are correlated to obtain a correlation coefficient, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor, and a suppression operation is taken on the risk factor according to the predicted occurrence time; the suppression operation is to postpone execution or prohibit execution;

[0089] The risk management module is used to obtain the corresponding first data according to the data tag of the risk factor and generate warning information, and send the warning information to the operation end and the management end; if it is detected that the operation end has not performed any operation within the safe time period before the risk prediction occurs, the management end will obtain the operation authority and perform safe operations.

[0090] It should be noted that, regarding the system in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0091] Finally, it should be noted that: Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A computer network information security analysis method based on big data, characterized in that: The method comprises: Acquire operation data in the system and add data tags through a data tagging method and record them as first data, and classify the first data according to the data tags to obtain second data; the operation data includes master data and knowledge base data; The operation data is preprocessed and feature extracted to obtain operation feature data, and the operation feature data is subjected to risk prediction through a safety analysis model to obtain an analysis result; the analysis result includes the risk type and the risk prediction occurrence time; when a risk occurs in the monitoring system, the risk data is entered into a risk analysis database and the safety analysis model is updated; The second data is securely stored according to the risk type; when the operating data in the monitoring system is determined to be abnormal data, the abnormal data and the risk type are correlated to obtain a correlation coefficient, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor, and a suppression operation is taken on the risk factor according to the risk prediction occurrence time; the suppression operation is to postpone execution or prohibit execution; The risk factor obtains the corresponding first data according to the data tag and generates warning information, and the warning information is sent to the operation end and the management end; if it is detected that the operation end does not perform operations within the safe time period before the risk prediction occurs, the management end will obtain the operation authority and perform safe operations.

2. According to the computer network information security analysis method based on big data in claim 1, it is characterized in that: The method of monitoring the operation data in the system, when the operation data is determined to be abnormal data, calculating the correlation coefficient between the abnormal data and the risk type through correlation calculation, and recording it as a risk factor when the correlation coefficient is greater than a preset correlation threshold, and taking a suppression operation on the risk factor according to the risk prediction occurrence time includes: Obtain the system's historical risk events and operating data before the risk events occur, the operating data before the risk events occur including data storage space, data operation volume, client operation volume, and module operation volume; identify the operating data that triggers the risk event through a data analysis method when the risk event occurs and record it as abnormal data; The system operation data and abnormal data are analyzed for correlation to obtain a correlation degree. When the correlation degree is greater than a preset risk correlation threshold, the operation data is determined to be abnormal data. Obtaining historical risk factors of the risk type, obtaining a correlation coefficient between the abnormal data and the historical risk factors through a correlation analysis method, and recording the abnormal data as a risk factor when the correlation coefficient is greater than a preset correlation threshold; The risk factor is used to find abnormal operation terminals through a network topology diagram, and the operation data of the abnormal operation terminals is obtained, and a data proportion analysis is performed to obtain a ranking result. According to the ranking result, the operation terminals with a high data proportion are preferentially suppressed. The suppression operation is evaluated by a risk suppression effect evaluation method to obtain an evaluation value. When the evaluation value is less than a preset risk assessment threshold, the suppression operation is performed. When the evaluation value is greater than the preset risk assessment threshold, a warning message is issued.

3. A computer network information security analysis method based on big data according to claim 2, characterized in that: The method of obtaining an evaluation value of the suppression operation through a risk suppression effect evaluation method comprises: The risk factor set for obtaining risk type is recorded as By adjusting the risk factors The inhibitory strength Get inhibition efficiency, risk factor The inhibition efficiency function The calculation formula is: ; in, is a preset parameter for controlling the degree of nonlinearity; ; , is the attenuation coefficient, is the preset initial suppression strength; By suppressing the efficiency function Risk Factors After suppression, the risk contribution is obtained. The calculation formula is: ; in, is a function that considers the decay of risk contribution over time. is the preset risk contribution attenuation constant; represents the initial risk contribution, which is obtained through statistical analysis of historical data; The risk factor set The risk contribution of is evaluated by the risk suppression effect evaluation method to obtain an evaluation value, and the evaluation value The calculation formula is: ; in, is the risk accumulation function, is the preset risk attenuation rate; Risk Factor The weight of the association with the risk type.

4. A computer network information security analysis method based on big data according to claim 2, characterized in that: The method of finding abnormal operation terminals by using the risk factors through a network topology diagram includes: Generate a network topology map by drawing, the network topology map includes a logical topology map and a physical topology map; monitor risk factors in real time through an integrated monitoring method of the network topology map; When a risk factor is detected, the abnormal operation end is located in the network topology map through an automatic association method; a risk tag is added to the abnormal operation end according to the risk type, and the risk level of the abnormal operation end is adjusted according to the tag attribute and the number of risk tags. When the risk level of the abnormal operation end is greater than the preset safety threshold, the abnormal operation end is listed for key monitoring; When the frequency of receiving warning information of the monitored abnormal operation terminal is greater than the preset safety frequency, the abnormal operation terminal is included in the risk list and risk processing is performed.

5. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The method for securely storing the second data according to the risk type includes: Extracting the second data by data feature to obtain feature data, obtaining the importance value, confidentiality level, and urgency value of the second data according to the feature data, and obtaining a comprehensive score value by a linear weighted algorithm; securely storing the second data in descending order of the comprehensive score values; the secure storage is to complete the data storage before the risk prediction occurs; When the frequency of occurrence of the monitored risk type is greater than the preset safety frequency, and the analysis curve obtained through statistical analysis of the frequency of occurrence of the risk type shows an increasing trend, the second data is safely stored according to the comprehensive score value and an early warning message is issued; When an abnormal surge occurs in the amount of monitored operation data, and the abnormal surge is greater than a preset safety surge, the data backup frequency and compression method are adjusted according to the abnormal surge; the preset safety surge is the minimum surge that triggers risks based on statistical historical risk events.

6. A computer network information security analysis method based on big data according to claim 4, characterized in that: The method of locating the abnormal operation end in the network topology map by the automatic association method when the risk factor is monitored includes: Obtain historical risk factors, build an association rule library between risk factors and abnormal operation ends based on the network topology map, match the risk factors monitored in real time with the association rule library and identify risk factor combinations that meet specific rules, and locate the abnormal operation end in the network topology map based on the risk factor combination.

7. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The method of performing risk prediction on the operation characteristic data through a safety analysis model to obtain an analysis result comprises: Acquire the historical operation data of the system, preprocess the historical operation data and obtain operation safety feature data through feature extraction; the historical operation data includes log data, traffic data, and behavior data; establish a mapping relationship between the operation safety feature data and the analysis results through a neural network algorithm to obtain a security analysis model.

8. A computer network information security analysis system based on big data, characterized in that: The system includes: a data processing module, a risk analysis module, a data management module, and a risk management module, and each module is sequentially connected to each other; A data processing module, used to obtain operation data in the system and add data tags through a data tagging method and record them as first data, and classify the first data according to the data tags to obtain second data; the operation data includes master data and knowledge base data; The risk analysis module is used to pre-process the operation data and obtain operation feature data through feature extraction, and to perform risk prediction on the operation feature data through a safety analysis model to obtain an analysis result; the analysis result includes the risk type and the predicted risk occurrence time; when a risk occurs in the monitoring system, the risk data is entered into the risk analysis database and the safety analysis model is updated; A data management module is used to safely store the second data according to the risk type; by monitoring the operation data in the system, when the operation data is determined to be abnormal data, the abnormal data and the risk type are correlated to obtain a correlation coefficient, and when the correlation coefficient is greater than a preset correlation threshold, it is recorded as a risk factor, and a suppression operation is taken on the risk factor according to the risk prediction occurrence time; the suppression operation is to postpone execution or prohibit execution; The risk management module is used to obtain the corresponding first data according to the data tag of the risk factor and generate warning information, and send the warning information to the operation end and the management end; if it is detected that the operation end has not performed any operation within the safe time period before the risk prediction occurs, the management end will obtain the operation authority and perform safe operations.

Images