Computer network secure data transmission method, system and electronic device

Abstract

The present application relates to the technical field of network security data transmission, and specifically to a computer network security data transmission method, system and electronic device, the method comprising: collecting user-related information of access requests and digitally encoding them, the user-related information including access data of different authentication categories and access time of access data, and access requests including real-time and historical access requests; marking the target authentication category, obtaining the real-time access difference factor of the target authentication category; establishing a historical access matrix and a real-time access matrix, obtaining access similarity feature values ​​of real-time access requests, and then obtaining access security factors of real-time access requests; performing identity security verification on access users of real-time access requests according to the access security factors, and transmitting computer network data to access users who have passed the identity security verification. The present application solves the problem of waste of user time and server resources caused by fixed identity authentication during computer network data transmission.

Description

Technical Field

[0001] The present application relates to the technical field of network security data transmission, and in particular to a computer network security data transmission method, system and electronic equipment. Background Art

[0002] Secure data transmission is an inevitable requirement for digital transformation and an important guarantee for the development of technologies such as the Internet of Things, cloud computing, and 5G. Authentication in the process of computer network data transmission verifies the identity of the recipient, prevents unauthorized users from obtaining access rights, and ensures the security and reliability of data transmission.

[0003] In the process of data transmission over a computer network, it is usually necessary to repeatedly confirm the identity of the accessing user through multiple authentication requests to ensure the security of the user data. However, this will cause unnecessary access delays to the user in terms of time, and will also increase the management cost of the service provider, resulting in a waste of server resources. However, blindly reducing the number of authentications may cause unauthorized users to obtain access rights, causing user data to be tampered with or stolen without knowing it. Therefore, it is necessary to determine the reasonable time and number of authentications in the process of data transmission over a computer network based on user behavior, to ensure that the access data transmission is secure and reliable while avoiding repeated authentication of reliable access users. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of this application is to provide a computer network security data transmission method, system and electronic device. The technical solutions adopted are as follows:

[0005] In a first aspect, an embodiment of the present application provides a computer network security data transmission method, the method comprising the following steps:

[0006] Collecting user-related information of a preset number of access requests and digitally encoding them, wherein the user-related information of each access request includes access data of different authentication categories and access time of the access data, and the access requests include real-time access requests and historical access requests, and the access data of historical access requests are recorded as historical access data, and the access data of real-time access requests are recorded as real-time access data;

[0007] Record any authentication category as the target authentication category, cluster the digital codes according to the differences between the digital codes of all historical access data of the target authentication category, determine the historical access clustering cluster of the target authentication category and the cluster center of the historical access clustering cluster, obtain the real-time data similarity of the target authentication category according to the similarity between the digital codes of the cluster centers of the historical access clustering cluster of the target authentication category and the digital codes of the real-time access data of the target authentication category, and obtain the real-time access difference factor of the target authentication category in combination with the difference in access time corresponding to the real-time access data of the target authentication category and the historical access data;

[0008] According to the user related information of the same access request in all access requests, a historical access matrix and a real-time access matrix are established, and according to the difference between the historical access matrix and the real-time access matrix, the access similarity feature value of the real-time access request is obtained, and the access security factor of the real-time access request is obtained by combining the difference between the real-time access difference factors of all authentication categories;

[0009] The access user of the real-time access request is authenticated according to the access security factor of the real-time access request, and the computer network data is transmitted to the access user who passes the identity security authentication.

[0010] Furthermore, the method for determining the historical access clusters of the target authentication category and the cluster centers of the historical access clusters is as follows:

[0011] The digital code of each historical access data of the target authentication category is respectively used as a node in the undirected graph, and the cumulative sum of the distances between the codes of all corresponding positions in the digital codes of two different nodes is used as the edge weight of the connection between the two different nodes to construct the undirected graph of the target authentication category; the nodes in the undirected graph of the target authentication category are clustered to obtain the historical access clustering clusters of the target authentication category;

[0012] Any node contained in the historical visit clustering cluster is recorded as the target node, the minimum value of the edge weight between each node contained in the historical visit clustering cluster and all other nodes is obtained, the minimum value of the edge weight between two different nodes is recorded as the shortest distance between the two different nodes, the cumulative sum of the shortest distances between the target node and all other nodes is recorded as the access distance of the target node, and the node with the shortest access distance contained in the historical visit clustering cluster is recorded as the cluster center of the historical visit clustering cluster.

[0013] Furthermore, the method for obtaining the real-time data similarity of the target authentication category is:

[0014] The similarity between the digital code of the cluster center of the historical access cluster of the target authentication category and the digital code of the real-time access data of the target authentication category is recorded as the data similarity of the historical access cluster, and the average of the data similarities of all historical access clusters of the target authentication category is recorded as the real-time data similarity of the target authentication category.

[0015] Furthermore, the real-time access difference factor of the target authentication category is obtained by combining the difference in access time corresponding to the real-time access data and the historical access data of the target authentication category. The specific process of obtaining the real-time access difference factor of the target authentication category is as follows:

[0016] According to the difference between the access time corresponding to the real-time access data and the historical access data of the target authentication category, the real-time access hysteresis of the target authentication category is obtained;

[0017] The ratio of the real-time access hysteresis of the target authentication category to the real-time data similarity is recorded as the real-time access difference factor of the target authentication category.

[0018] Further, the real-time access hysteresis of the target authentication category is obtained according to the difference in access time corresponding to the real-time access data and the historical access data of the target authentication category. The specific process of obtaining is:

[0019] The time difference between the access time corresponding to the real-time access data of the target authentication category and the access time corresponding to the cluster center of the historical access cluster of the target authentication category is recorded as the time lag length of the historical access cluster of the target authentication category, and the average of the time lag lengths of all historical access clusters of the target authentication category is recorded as the real-time access lag of the target authentication category.

[0020] Further, the method for determining the access similarity feature value of the real-time access request is:

[0021] Take any historical access matrix and real-time access matrix together as the input of ANOSIM matrix similarity analysis algorithm, and obtain the global R value and significance level value between the historical access matrix and the real-time access matrix;

[0022] The ratio of the global R value to the significance level between the historical access matrix and the real-time access matrix is ​​recorded as the information difference of the historical access matrix, the cumulative sum of the information differences of all historical access matrices is recorded as the access information difference of the real-time access request, and the ratio of the number 1 to the access information difference of the real-time access request is recorded as the access similarity feature value of the real-time access request.

[0023] Furthermore, the access security factor of the real-time access request is obtained by combining the differences between the real-time access difference factors of all authentication categories. The specific process of obtaining the access security factor is as follows:

[0024] The mean of the real-time access difference factors of all authentication categories is recorded as the access difference mean of the real-time access request, the sum of the absolute values ​​of the differences between the real-time access difference factors of all authentication categories and the access difference mean of the real-time access request is recorded as the access difference sum of the real-time access request, and the access difference stability of the real-time access request is obtained according to the access difference sum of the real-time access request, wherein the access difference stability of the real-time access request is negatively correlated with the access difference sum of the real-time access request;

[0025] The linear normalized value of the product of the access similarity feature value and the access difference stability of the real-time access request is recorded as the access security factor of the real-time access request.

[0026] Furthermore, the identity security verification of the access user of the real-time access request is performed according to the access security factor of the real-time access request, and the specific process is as follows:

[0027] When the access security factor of the real-time access request is greater than or equal to the access security threshold, it is determined that the identity security verification of the access user has passed;

[0028] When the access security factor of the real-time access request is less than the access security threshold, the identity of the access user is securely verified to determine the access user who has passed the identity security verification. In a second aspect, the embodiment of the present application also provides a computer network security data transmission system, the data transmission system comprising:

[0029] An access request data collection module is used to collect user-related information of a preset number of access requests and digitally encode them. The user-related information of each access request includes access data of different authentication categories and access time of the access data. The access requests include real-time access requests and historical access requests. The access data of historical access requests are recorded as historical access data, and the access data of real-time access requests are recorded as real-time access data.

[0030] An access request analysis module is used to record any authentication category as a target authentication category, cluster digital codes according to the differences between digital codes of all historical access data of the target authentication category, determine the historical access clustering cluster of the target authentication category and the cluster center of the historical access clustering cluster, obtain the real-time data similarity of the target authentication category according to the similarity between the digital code of the cluster center of the historical access clustering cluster of the target authentication category and the digital code of the real-time access data of the target authentication category, and obtain the real-time access difference factor of the target authentication category in combination with the difference in access time corresponding to the real-time access data of the target authentication category and the historical access data;

[0031] The authentication category analysis module is used to establish a historical access matrix and a real-time access matrix based on the user-related information of the same access request in all access requests, obtain the access similarity feature value of the real-time access request based on the difference between the historical access matrix and the real-time access matrix, and obtain the access security factor of the real-time access request by combining the difference between the real-time access difference factors of all authentication categories;

[0032] The security verification module is used to perform identity security verification on the access user of the real-time access request according to the access security factor of the real-time access request, and transmit computer network data to the access user who passes the identity security verification.

[0033] In a third aspect, an embodiment of the present application provides an electronic device for secure data transmission over a computer network, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of any one of the above methods when executing the computer program.

[0034] It can be seen from the above embodiments that the computer network secure data transmission method, system and electronic device provided by the embodiments of the present application have at least the following beneficial effects:

[0035] The present application first determines the identity security of the access user based on the difference between the historical access data and the real-time access data of the access user. Specifically, in order to avoid the influence of the difference between different historical access data on the above difference evaluation, first, the cluster center of the historical access cluster is determined according to the difference between the digital codes of the historical access data. The cluster center of the historical access cluster is the most representative data of the access user in the historical data. Then, according to the similarity between the digital code of the cluster center of the historical access cluster of the target authentication category and the digital code of the real-time access data of the target authentication category, and the difference between the access time corresponding to the real-time access data of the target authentication category and the historical access data, the real-time access difference factor of the target authentication category is obtained. When the real-time access difference factor of the target authentication category is larger, the possibility of changes in the computer network access environment and access characteristics of the access user is greater, and the identity of the access user should be verified to ensure the transmission security of computer network data. Then, the differences in real-time access data between all authentication categories are comprehensively considered, and the analysis is continued. According to the difference between the historical access matrix and the real-time access matrix, the real-time access difference factor of the target authentication category is obtained. The access similarity feature value of the request, the smaller the access similarity feature value of the real-time access request, the greater the difference between the access environment and access features of the access request corresponding to the historical access matrix and the real-time access matrix, the more the identity of the access user should be verified to ensure the security of computer network data transmission. Further, combined with the differences between the real-time access difference factors of all authentication categories, the access security factor of the real-time access request is obtained. The access security factor of the real-time access request is a comprehensive evaluation of the similarity between the user's access data and access environment and the historical access data and access environment. When the access security factor of the real-time access request is smaller, the possibility that the real-time access request is an operation of other unauthorized users is greater, and the identity of the access user should be verified; finally, the access user of the real-time access request is authenticated according to the access security factor of the real-time access request, and the computer network data is transmitted for the access user who passes the identity security verification. The present application can realize user identity authentication only for real-time access requests with large changes in access data and access environment, and solve the problem of waste of user time and server resources caused by fixed identity authentication during computer network data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 A flowchart of a method for secure data transmission over a computer network provided by an embodiment of the present application;

[0038] Figure 2 A flowchart for obtaining access security factors provided by an embodiment of the present application;

[0039] Figure 3 A schematic diagram of the structure of a computer network security data transmission system provided for one embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to further explain the technical means and effects adopted by this application to achieve the predetermined invention purpose, the following is a detailed description of a computer network security data transmission method, system and electronic device proposed in this application, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, all technical and scientific terms used in this application have the same meaning as those commonly understood by technicians in the technical field of this application.

[0041] The following describes in detail a computer network secure data transmission method, system and specific scheme of electronic equipment provided by the present application with reference to the accompanying drawings.

[0042] See also Figure 1 , which shows a flowchart of a method for secure data transmission over a computer network provided by an embodiment of the present application, the method comprising the following steps:

[0043] S001: Collect user-related information of a preset number of access requests and perform digital encoding. The user-related information of each access request includes access data of different authentication categories and access time of the access data. The access requests include real-time access requests and historical access requests. The access data of historical access requests are recorded as historical access data, and the access data of real-time access requests are recorded as real-time access data.

[0044] When a user accesses a computer network, sends an access request and requires the computer network to perform a data transfer operation, the computer network will send an authorization instruction to the accessing user to obtain user-related information in the computer network.

[0045] Among them, the user-related information in this embodiment includes access data and access time of access data; access data includes access IP address, network access device port number, network access operation, etc.; network access operation includes query, download, storage, etc.; in actual application, as other implementation methods, the implementer can determine the type of data included in the user-related information according to actual conditions, and this application does not impose any special restrictions.

[0046] It can be understood that when the access request is at the current moment, the access request is recorded as a real-time access request; when the access request is not at the current moment, the access request is recorded as a historical access request.

[0047] A hash function is used to map all non-digital user-related information into digital codes. According to the data type of the user-related information selected in this embodiment, the user-related information is divided into three authentication categories: IP address, network access device port number, and network access operation.

[0048] Among them, this embodiment sets the number of historical access data collected for each authentication category to 200, and sets 3 categories of authentication categories. In actual application, as other implementation methods, the implementer can decide the number of historical access data collected for each authentication category and the number of authentication categories according to actual conditions, and this application does not impose any special restrictions.

[0049] It can be understood that there is a total of one real-time access request. Since the number of historical access data collected for each authentication category is set to 200 in this embodiment, a total of 200 historical access requests are collected.

[0050] It should be noted that, in order to facilitate calculation, all user-related information analyzed in this embodiment has been subjected to data preprocessing, the digital code lengths of all user-related information are the same, and all user-related information has been subjected to data cleaning. Specifically, the maximum value of the digital code length of all user-related information is obtained, and all user-related information whose digital code length is less than the maximum value is supplemented with the number 0, so as to unify the digital code length of all user-related information.

[0051] Specifically, using hash functions to digitally encode information and perform data cleaning processing are both well-known technologies and will not be described in detail.

[0052] At this point, real-time access data of different authentication categories, a preset number of historical access data, and access times of all access data are obtained.

[0053] S002: Record any authentication category as the target authentication category, cluster the digital codes according to the differences between the digital codes of all historical access data of the target authentication category, determine the historical access clustering cluster of the target authentication category and the cluster center of the historical access clustering cluster, obtain the real-time data similarity of the target authentication category according to the similarity between the digital codes of the cluster centers of the historical access clustering clusters of the target authentication category and the digital codes of the real-time access data of the target authentication category, and obtain the real-time access difference factor of the target authentication category based on the difference in access time corresponding to the real-time access data of the target authentication category and the historical access data.

[0054] When a user requests a computer network to transmit data, the identity security of the accessing user can be judged through the user-related information of the accessing user, thereby avoiding the problem of wasting user time and server resources caused by repeated identity authentication operations. The greater the difference between the real-time access data and the historical access data in the user-related information of the same authentication category, the greater the change in the user's access environment or access characteristics. At this time, the identity of the accessing user should be verified to ensure the security of computer network data transmission.

[0055] Any authentication category is recorded as the target authentication category. This embodiment is described by taking any authentication category as an example.

[0056] The digital code of each historical access data of the target authentication category is taken as a node in the undirected graph, and the cumulative sum of the distances between the codes of all corresponding positions in the digital codes of two different nodes is taken as the edge weight of the connection between the two different nodes to construct the undirected graph of the target authentication category. The Chameleon clustering algorithm is used to cluster the nodes in the undirected graph of the target authentication category to obtain the historical access clustering clusters of the target authentication category.

[0057] It can be understood that, since the present embodiment sets the number of collected historical access data of each authentication category to 200, the number of nodes in the undirected graph of the target authentication category is 200.

[0058] At the same time, it can be understood that in an undirected graph, two nodes are not only directly connected, but can also be indirectly connected through other nodes. When two nodes are directly connected, the edge weight between the two nodes is the edge weight of the connection. When two nodes are indirectly connected through other nodes, the edge weight between the two nodes is the sum of all indirectly connected edge weights. Therefore, the edge weight between two nodes can have multiple values.

[0059] Any node included in the historical access cluster is recorded as the target node. This embodiment is described by taking any node included in the historical access cluster as an example.

[0060] The minimum value of the edge weight between each node and all other nodes in the historical access cluster is obtained through the Dijkstra algorithm. The minimum value of the edge weight between two different nodes is recorded as the shortest distance between the two different nodes, and the cumulative sum of the shortest distances between the target node and all other nodes is recorded as the access distance of the target node. Among them, the access distance of any node contained in the historical access cluster can be obtained in the same way, that is, each node contained in the historical access cluster has a corresponding access distance. The node with the smallest access distance contained in the historical access cluster is recorded as the cluster center of the historical access cluster.

[0061] The edge weight of the connection between two different nodes is an evaluation of the difference in information between the nodes. Therefore, the cluster center of the historical access cluster is obtained by evaluating the difference in information between the nodes contained in the cluster. The determination of the cluster center of the historical access cluster provides a basis for evaluating the difference between real-time access data and historical access data.

[0062] Among them, this embodiment uses the Levenshtein distance between codes to calculate the edge weight of the connection between two different nodes, adopts the Chameleon clustering algorithm to obtain the historical access clustering cluster, and adopts the Dijkstra algorithm to obtain the minimum value of the edge weight between nodes. In the actual application process, as other implementation methods, the implementer may also adopt other distance calculation methods, clustering methods and methods for determining the minimum value of edge weight in the prior art. This embodiment is not limited. The calculation of Levenshtein distance, clustering using the Chameleon clustering algorithm, and the Dijkstra algorithm are all well-known technologies and will not be repeated here.

[0063] Preferably, as an embodiment of the present application, the similarity between the digital code of the cluster center of the historical access clustering cluster of the target authentication category and the digital code of the real-time access data of the target authentication category is recorded as the data similarity of the historical access clustering cluster, and the average of the data similarities of all historical access clustering clusters of the target authentication category is recorded as the real-time data similarity of the target authentication category.

[0064] Among them, this embodiment selects cosine similarity as the similarity measure between digital codes. The implementer can use other methods in the prior art such as Pearson correlation coefficient to measure the similarity between digital codes, and this application does not make any special restrictions.

[0065] The smaller the similarity between the digital code of the cluster center of the historical access cluster of the same authentication category and the digital code of the real-time access data, the greater the difference between the data generated by the user's real-time access and the data obtained during the user's historical access in the data of the same authentication category, the greater the possibility that the user is another unauthorized user, and the more identity authentication should be performed on the access user at this time.

[0066] At this point, the real-time data similarity of the target authentication category is obtained. The real-time data similarity of each authentication category can be obtained in the same way.

[0067] According to the difference between the access time corresponding to the real-time access data and the historical access data of the target authentication category, the real-time access hysteresis of the target authentication category is obtained. The real-time access hysteresis of the target authentication category is positively correlated with the difference between the access time corresponding to the real-time access data and the historical access data of the target authentication category.

[0068] Preferably, as an embodiment of the present application, the time difference between the access time corresponding to the real-time access data of the target authentication category and the access time corresponding to the cluster center of the historical access cluster cluster of the target authentication category is recorded as the time lag length of the historical access cluster cluster of the target authentication category, and the average of the time lag lengths of all historical access cluster clusters of the target authentication category is recorded as the real-time access lag of the target authentication category.

[0069] The calculation formula for the real-time access hysteresis of the target authentication category is:

[0070]

[0071] in, Indicates the target authentication type Real-time access lag; Indicates the target authentication type The number of historical access clusters; Indicates the target authentication type The access time corresponding to the real-time access data; Indicates the target authentication type Historical access clustering The access time corresponding to the cluster center.

[0072] The longer the time period between the access times corresponding to real-time access data and historical access data, the greater the possibility that the computer network access environment and access characteristics of the accessing user will change, and the more the identity of the accessing user should be verified to ensure the security of computer network data transmission. At this time, the real-time access lag of the target authentication category is greater.

[0073] At this point, the real-time access hysteresis of the target authentication category is obtained. The real-time access hysteresis of each authentication category can be obtained in the same way.

[0074] According to the real-time data similarity and real-time access hysteresis of the target authentication category, a real-time access difference factor of the target authentication category is obtained. The real-time access difference factor of the target authentication category is positively correlated with the real-time access hysteresis of the target authentication category and negatively correlated with the real-time data similarity of the target authentication category.

[0075] Preferably, as an embodiment of the present application, the ratio of the real-time access hysteresis of the target authentication category to the real-time data similarity is recorded as the real-time access difference factor of the target authentication category.

[0076] In the process of calculating the ratio, in order to avoid the situation where the denominator is zero, a preset value needs to be added to the denominator, and an embodiment of the preset value is 1.

[0077] When the real-time access lag of the target authentication category is greater, the real-time data similarity of the target authentication category is smaller, and the real-time access difference factor of the target authentication category is greater, at this time, the possibility of changes in the computer network access environment and access characteristics of the accessing user is greater, and the identity of the accessing user should be verified to ensure the security of computer network data transmission.

[0078] At this point, the real-time access difference factor of the target authentication category is obtained. The real-time access difference factor of each authentication category can be obtained in the same way.

[0079] S003: Based on the user-related information of the same access request in all access requests, a historical access matrix and a real-time access matrix are established. Based on the differences between the historical access matrix and the real-time access matrix, access similarity feature values ​​of real-time access requests are obtained. Combined with the differences between the real-time access difference factors of all authentication categories, the access security factor of the real-time access request is obtained.

[0080] If the user's identity is judged only by the real-time access difference factor of each authentication category, when the user's real-time access data is significantly different from the historical access data or the user's access frequency is low, the user requesting real-time access may be misjudged as an unauthorized user, further resulting in the problem of wasted user time and server resources. Therefore, the differences in real-time access data between all authentication categories are comprehensively considered and the analysis is continued.

[0081] The access matrix of the user in the same access is obtained according to the user related information collected by the user in the same access.

[0082] It should be noted that the same row of data in the access matrix is ​​the digital code of the same authentication category, that is, each number in the digital code of the same authentication category is arranged in sequence to obtain a row of data in the access matrix; this embodiment arranges the row data of the access matrix corresponding to the three authentication categories of IP address, network access device port number, and network access operation collected in the same access in order from top to bottom to obtain the access matrix collected in the same access. In actual application, the implementer can decide the arrangement order of the authentication categories in the access matrix from top to bottom according to the actual situation, and no limitation is made here.

[0083] The access matrix is ​​classified according to the collection time of the user-related information. The access matrix composed of real-time access data is recorded as a real-time access matrix, and the access matrix composed of historical access data is recorded as a historical access matrix.

[0084] It can be understood that, in this embodiment, the number of historical access data collected for each authentication category is set to 200, so the number of historical access matrices is 200.

[0085] Any historical access matrix and real-time access matrix are used together as the input of the ANOSIM matrix similarity analysis algorithm to obtain the global R value and significance level value between the historical access matrix and the real-time access matrix.

[0086] It should be noted that there is a corresponding global R value and a corresponding significance level value between each historical access matrix and the real-time access matrix, that is, there is a corresponding global R value and a corresponding significance level value between any historical access matrix and the real-time access matrix; using the ANOSIM matrix similarity analysis algorithm to obtain the global R value and significance level value between the two matrices is a well-known technology and will not be repeated here.

[0087] When the global R value between the historical access matrix and the real-time access matrix is ​​larger relative to the significance level value, the difference between the historical access matrix and the real-time access matrix is ​​larger, and the difference between the access environment and access characteristics of the access requests corresponding to the historical access matrix and the real-time access matrix is ​​larger. At this time, the identity of the accessing user should be verified to ensure the security of computer network data transmission.

[0088] According to the global R value and significance level between all historical access matrices and real-time access matrices, the access similarity feature value of the real-time access request is obtained.

[0089] Preferably, as an embodiment of the present application, the ratio of the global R value to the significance level between the historical access matrix and the real-time access matrix is ​​recorded as the information difference of the historical access matrix, the cumulative sum of the information differences of all historical access matrices is recorded as the access information difference of the real-time access request, and the ratio of the number 1 to the access information difference of the real-time access request is recorded as the access similarity feature value of the real-time access request.

[0090] In the process of calculating the ratio, in order to avoid the situation where the denominator is zero, a preset value needs to be added to the denominator, and an embodiment of the preset value is 1.

[0091] The calculation formula for the access similarity feature value of real-time access requests is:

[0092]

[0093] In the formula, An access similarity feature value representing a real-time access request; Represents the number of historical access matrices; Indicates The global R value between the historical access matrix and the real-time access matrix; Indicates The significance level between the historical access matrix and the real-time access matrix; It represents a preset adjustment parameter. In this embodiment, the value of the preset adjustment parameter is 1. The function of the preset adjustment parameter is to avoid the denominator being zero.

[0094] When the global R value between the historical access matrix and the real-time access matrix is ​​larger relative to the significance level value, the difference between the historical access matrix and the real-time access matrix is ​​larger, the difference between the access environment and access characteristics of the access requests corresponding to the historical access matrix and the real-time access matrix is ​​larger, and the access similarity feature value of the real-time access request is smaller. At this time, the identity of the accessing user should be verified to ensure the security of computer network data transmission.

[0095] According to the difference between the real-time access difference factors of all authentication categories, the access difference stability of the real-time access request is obtained. The access difference stability of the real-time access request is negatively correlated with the difference between the real-time access difference factors of all authentication categories.

[0096] Preferably, as an embodiment of the present application, the mean of the real-time access difference factors of all authentication categories is denoted as the mean access difference of real-time access requests, the sum of the absolute values ​​of the differences between the real-time access difference factors of all authentication categories and the mean access difference of real-time access requests is denoted as the sum of access differences of real-time access requests, and the exponential power with the opposite of the sum of access differences of real-time access requests as the exponent and a natural constant as the base is denoted as the access difference stability of real-time access requests.

[0097] In actual application, as another implementation, the linear normalized value of the inverse of the sum of the access differences of the real-time access requests is recorded as the access difference stability of the real-time access requests.

[0098] The smaller the difference between the real-time access difference factors of all authentication categories, the greater the access difference stability of the real-time access request. When sending a real-time access request to access a computer network, the more consistent the degree of change in the computer network access environment and access characteristics presented by user-related information of different authentication categories.

[0099] According to the access similarity feature value and access difference stability of the real-time access request, an access security factor of the real-time access request is obtained. The access security factor of the real-time access request is positively correlated with the access similarity feature value and access difference stability of the real-time access request.

[0100] Preferably, as an embodiment of the present application, a linear normalized value of the product of the access similarity feature value and the access difference stability of the real-time access request is recorded as the access security factor of the real-time access request.

[0101] The smaller the access similarity feature value and access difference stability of the real-time access request, the smaller the access security factor of the real-time access request. At this time, the real-time access request is more likely to be an operation by other unauthorized users, and the identity of the accessing user should be verified to ensure the security of computer network data transmission.

[0102] At this point, the access security factor of the real-time access request is obtained. The access security factor acquisition flow chart is as follows: Figure 2 shown.

[0103] S004: Perform identity security verification on the access user of the real-time access request according to the access security factor of the real-time access request, and transmit computer network data to the access user who passes the identity security verification.

[0104] An access security threshold U is set. In this embodiment, the value of the access security threshold U is 0.6.

[0105] It is understandable that, when the access security threshold U is larger, the access security requirement for the real-time access request is more stringent, and the implementer can also select the value of the access security threshold U according to needs.

[0106] When the access security factor of the real-time access request is greater than or equal to the access security threshold U, the real-time access request is considered to be in a secure access state, and there is no need to perform security verification on the identity of the accessing user before computer network data transmission, and the identity security verification of the accessing user is directly passed; when the access security factor of the real-time access request is less than the access security threshold U, the real-time access request is considered to be in an abnormal access state, and there is a need to perform security verification on the identity of the accessing user before computer network data transmission, so as to screen out accessing users who have passed the identity security verification for data transmission.

[0107] Among them, the methods for securely verifying the identity of the accessing user may be dynamic face recognition, fingerprint verification, terminal information authorization, etc.

[0108] When the identity security verification of the access user is passed, the computer network data is transmitted to the access user who requests the computer network to perform a data transmission operation.

[0109] The specific transmission process of computer network data is as follows:

[0110] A three-way handshake protocol is used to establish a connection between a computer network and an accessing user. The computer network divides data into TCP segments of the same length through the TCP protocol. Each TCP segment contains a sequence number that is used to ensure the order and integrity of the data.

[0111] After the accessing user receives the data, it sends an ACK message to the computer network to confirm that the data has been received.

[0112] When data transmitted from a computer network to an accessing user is out of order during the transmission process, the TCP protocol is used to restore the out-of-order data to its original order and to check for data errors in the data transmitted over the computer network.

[0113] During the verification process, when data errors are detected in network transmission data, the accessing user will discard the damaged TCP segment and wait for retransmission by the computer network. After that, the connection between the computer network and the accessing user will be closed through the four-wave protocol.

[0114] The transmission of computer network data is a well-known technology and will not be described in detail.

[0115] At this point, the transmission of computer network security data is completed.

[0116] Based on the same inventive concept as the above method, an embodiment of the present application also provides an electronic device for secure computer network data transmission, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of any one of the above-mentioned methods for secure computer network data transmission when executing the computer program.

[0117] See also Figure 3 , Figure 3 1 is a schematic diagram of the structure of a computer network security data transmission system provided by an embodiment of the present application. In this embodiment, the various units included in the device are used to execute the various steps in the embodiment corresponding to a computer network security data transmission method. Figure 3 The data transmission device includes: an access request data collection module, an access request analysis module, an authentication category analysis module, and a security verification module.

[0118] An access request data collection module is used to collect user-related information of a preset number of access requests and digitally encode them. The user-related information of each access request includes access data of different authentication categories and access time of the access data. The access requests include real-time access requests and historical access requests. The access data of historical access requests are recorded as historical access data, and the access data of real-time access requests are recorded as real-time access data.

[0119] An access request analysis module is used to record any authentication category as a target authentication category, cluster digital codes according to the differences between digital codes of all historical access data of the target authentication category, determine the historical access clustering cluster of the target authentication category and the cluster center of the historical access clustering cluster, obtain the real-time data similarity of the target authentication category according to the similarity between the digital code of the cluster center of the historical access clustering cluster of the target authentication category and the digital code of the real-time access data of the target authentication category, and obtain the real-time access difference factor of the target authentication category in combination with the difference in access time corresponding to the real-time access data of the target authentication category and the historical access data;

[0120] The authentication category analysis module is used to establish a historical access matrix and a real-time access matrix based on the user-related information of the same access request in all access requests, obtain the access similarity feature value of the real-time access request based on the difference between the historical access matrix and the real-time access matrix, and obtain the access security factor of the real-time access request by combining the difference between the real-time access difference factors of all authentication categories;

[0121] The security verification module is used to perform identity security verification on the access user of the real-time access request according to the access security factor of the real-time access request, and transmit computer network data to the access user who passes the identity security verification.

[0122] It is to be understood that the sequence of the embodiments of the present application described above is for description only and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of the present specification. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0123] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0124] The above content is only an implementation method of the present application and is not intended to limit the scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the protection scope of the present application.

Claims

1. A computer network secure data transmission method, characterized in that: The method comprises the following steps: Collecting user-related information of a preset number of access requests and digitally encoding them, wherein the user-related information of each access request includes access data of different authentication categories and access time of the access data, and the access requests include real-time access requests and historical access requests, and the access data of historical access requests are recorded as historical access data, and the access data of real-time access requests are recorded as real-time access data; Record any authentication category as the target authentication category, cluster the digital codes according to the differences between the digital codes of all historical access data of the target authentication category, determine the historical access clustering cluster of the target authentication category and the cluster center of the historical access clustering cluster, obtain the real-time data similarity of the target authentication category according to the similarity between the digital codes of the cluster centers of the historical access clustering cluster of the target authentication category and the digital codes of the real-time access data of the target authentication category, and obtain the real-time access difference factor of the target authentication category in combination with the difference in access time corresponding to the real-time access data of the target authentication category and the historical access data; According to the user related information of the same access request in all access requests, a historical access matrix and a real-time access matrix are established, and according to the difference between the historical access matrix and the real-time access matrix, the access similarity feature value of the real-time access request is obtained, and the access security factor of the real-time access request is obtained by combining the difference between the real-time access difference factors of all authentication categories; The access user of the real-time access request is authenticated according to the access security factor of the real-time access request, and the computer network data is transmitted to the access user who passes the identity security authentication.

2. A computer network secure data transmission method as claimed in claim 1, characterized in that: The method for determining the historical access clustering cluster of the target authentication category and the clustering center of the historical access clustering cluster is: The digital code of each historical access data of the target authentication category is respectively used as a node in the undirected graph, and the cumulative sum of the distances between the codes of all corresponding positions in the digital codes of two different nodes is used as the edge weight of the connection between the two different nodes to construct the undirected graph of the target authentication category; Clustering the nodes in the undirected graph of the target authentication category to obtain the historical access clustering clusters of the target authentication category; Any node contained in the historical visit clustering cluster is recorded as the target node, the minimum value of the edge weight between each node contained in the historical visit clustering cluster and all other nodes is obtained, the minimum value of the edge weight between two different nodes is recorded as the shortest distance between the two different nodes, the cumulative sum of the shortest distances between the target node and all other nodes is recorded as the access distance of the target node, and the node with the shortest access distance contained in the historical visit clustering cluster is recorded as the cluster center of the historical visit clustering cluster.

3. A computer network secure data transmission method as claimed in claim 1, characterized in that: The method for obtaining the real-time data similarity of the target authentication category is: The similarity between the digital code of the cluster center of the historical access cluster of the target authentication category and the digital code of the real-time access data of the target authentication category is recorded as the data similarity of the historical access cluster, and the average of the data similarities of all historical access clusters of the target authentication category is recorded as the real-time data similarity of the target authentication category.

4. A computer network secure data transmission method as claimed in claim 1, characterized in that: The real-time access difference factor of the target authentication category is obtained by combining the difference in access time corresponding to the real-time access data and the historical access data of the target authentication category. The specific process of obtaining the real-time access difference factor of the target authentication category is as follows: According to the difference between the access time corresponding to the real-time access data and the historical access data of the target authentication category, the real-time access hysteresis of the target authentication category is obtained; The ratio of the real-time access hysteresis of the target authentication category to the real-time data similarity is recorded as the real-time access difference factor of the target authentication category.

5. A computer network secure data transmission method as claimed in claim 4, characterized in that: The real-time access hysteresis of the target authentication category is obtained according to the difference in access time corresponding to the real-time access data and the historical access data of the target authentication category. The specific process of obtaining is: The time difference between the access time corresponding to the real-time access data of the target authentication category and the access time corresponding to the cluster center of the historical access cluster of the target authentication category is recorded as the time lag length of the historical access cluster of the target authentication category, and the average of the time lag lengths of all historical access clusters of the target authentication category is recorded as the real-time access lag of the target authentication category.

6. A computer network secure data transmission method as claimed in claim 1, characterized in that: The method for determining the access similarity characteristic value of the real-time access request is: Take any historical access matrix and real-time access matrix together as the input of ANOSIM matrix similarity analysis algorithm, and obtain the global R value and significance level value between the historical access matrix and the real-time access matrix; The ratio of the global R value to the significance level between the historical access matrix and the real-time access matrix is ​​recorded as the information difference of the historical access matrix, the cumulative sum of the information differences of all historical access matrices is recorded as the access information difference of the real-time access request, and the ratio of the number 1 to the access information difference of the real-time access request is recorded as the access similarity feature value of the real-time access request.

7. A computer network secure data transmission method as claimed in claim 1, characterized in that: The access security factor of the real-time access request is obtained by combining the differences between the real-time access difference factors of all authentication categories. The specific process of obtaining the access security factor is as follows: The mean of the real-time access difference factors of all authentication categories is recorded as the access difference mean of the real-time access request, the sum of the absolute values ​​of the differences between the real-time access difference factors of all authentication categories and the access difference mean of the real-time access request is recorded as the access difference sum of the real-time access request, and the access difference stability of the real-time access request is obtained according to the access difference sum of the real-time access request, wherein the access difference stability of the real-time access request is negatively correlated with the access difference sum of the real-time access request; The linear normalized value of the product of the access similarity feature value and the access difference stability of the real-time access request is recorded as the access security factor of the real-time access request.

8. A computer network secure data transmission method as claimed in claim 1, characterized in that: The identity security verification of the access user of the real-time access request is performed according to the access security factor of the real-time access request, and the specific process is as follows: When the access security factor of the real-time access request is greater than or equal to the access security threshold, it is determined that the identity security verification of the access user has passed; When the access security factor of the real-time access request is less than the access security threshold, the identity of the access user is security verified to determine the access user who has passed the identity security verification.

9. A computer network secure data transmission system, characterized in that: The data transmission system comprises: An access request data collection module is used to collect user-related information of a preset number of access requests and digitally encode them. The user-related information of each access request includes access data of different authentication categories and access time of the access data. The access requests include real-time access requests and historical access requests. The access data of historical access requests are recorded as historical access data, and the access data of real-time access requests are recorded as real-time access data. An access request analysis module is used to record any authentication category as a target authentication category, cluster digital codes according to the differences between digital codes of all historical access data of the target authentication category, determine the historical access clustering cluster of the target authentication category and the cluster center of the historical access clustering cluster, obtain the real-time data similarity of the target authentication category according to the similarity between the digital code of the cluster center of the historical access clustering cluster of the target authentication category and the digital code of the real-time access data of the target authentication category, and obtain the real-time access difference factor of the target authentication category in combination with the difference in access time corresponding to the real-time access data of the target authentication category and the historical access data; The authentication category analysis module is used to establish a historical access matrix and a real-time access matrix based on the user-related information of the same access request in all access requests, obtain the access similarity feature value of the real-time access request based on the difference between the historical access matrix and the real-time access matrix, and obtain the access security factor of the real-time access request by combining the difference between the real-time access difference factors of all authentication categories; The security verification module is used to perform identity security verification on the access user of the real-time access request according to the access security factor of the real-time access request, and transmit computer network data to the access user who passes the identity security verification.

10. An electronic device for secure data transmission over a computer network, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images