Information security analysis method and system based on big data

Abstract

The present invention relates to the field of information security data processing technology, and in particular to an information security analysis method and system based on big data. Compared with the prior art, the present invention trains an input interval prediction neural network through user input information big data, judges the interval time vector that a character string should have through the input interval prediction neural network, and uses the interval time vector to verify the user, so that the entire method has accuracy and universality based on big data. On this basis, the present invention also obtains the input interval tolerance value of each character through user input information big data analysis. The input interval tolerance value reflects the difference in the input of the same character by different users. In this way, the combined input interval tolerance value and the input interval prediction neural network can obtain a reasonable input interval range that includes individual differences, thereby achieving effective verification of the user, greatly reducing the probability of misjudgment, and having good practicality.

Description

Technical Field

[0001] The present invention relates to the field of information security data processing technology, and in particular to an information security analysis method and system based on big data. Background Art

[0002] The importance of information security cannot be underestimated. Protecting data from unauthorized access and potential threats is one of the top priorities for any organization. In today's digital and Internet-based world, information security is not only about the robust protection of technical systems, but also about respecting privacy and business confidentiality, as well as complying with personal data protection laws.

[0003] Existing verification technologies have evolved to the point where they need to be more complex and efficient. One of the existing methods is to strengthen the security of password verification by inputting intervals. This technology requires users to enter a certain time interval during the password input process to ensure the authenticity and security of the input. By introducing interval verification, the system can effectively prevent automated attacks and unauthorized access attempts, thereby improving the overall security level and reducing the risk of being hacked.

[0004] However, existing interval verification technologies all use fixed models to deduce fixed standard intervals, without considering differences between individual users, such as different typing speeds between young and old people, and different keyboard forms used by different users, such as nine-grid and full keyboards, which leads to a high probability of false verification in existing technologies. Therefore, people need an interval verification technology that can take into account differences between individuals. Summary of the invention

[0005] Therefore, the present invention provides an information security analysis method and system based on big data, so as to solve the problem that the interval verification technology in the prior art does not take the differences between individual users into consideration.

[0006] The present invention provides an information security analysis method based on big data, comprising:

[0007] Obtaining user input information big data, the user input information big data includes each user's identity information, historical passwords and historical input records, the historical input records include the character input interval corresponding to each time the historical password is input;

[0008] According to each historical password and historical input record, a training set is established, wherein the training set includes a plurality of data pairs, and the data pair includes a character string and an interval time vector corresponding to the character string;

[0009] Based on the training set, the input interval prediction neural network is trained to predict the interval time vector of a string input;

[0010] According to the identity information, historical passwords and historical input records, the input interval tolerance value of each character is analyzed;

[0011] The user is verified based on the trained input interval prediction neural network and the input interval tolerance value of each character.

[0012] The present invention also provides a preferred solution: the training set is established according to each historical password and historical input record, including:

[0013] Obtaining a target historical password, a historical input record corresponding to the target historical password, and an input length of an input interval prediction neural network, wherein the target historical password is the current historical password to be analyzed, and the unit of the input length is the number of characters;

[0014] Based on the historical input records, count the number of inputs corresponding to the target historical password;

[0015] According to the number of inputs and the input length, the target step length is obtained;

[0016] A sliding window is set on the historical target password, the sliding window is moved based on the target step length, and characters in the sliding window are extracted to obtain multiple character strings, wherein the length of the sliding window is equal to the input length;

[0017] According to the character input interval in the historical input record corresponding to the target historical password, based on multiple character strings, the interval time vectors corresponding to the multiple character strings are obtained, and the data pairs in the training set are obtained.

[0018] The present invention also provides a preferred solution: the step of obtaining the target step length according to the number of inputs and the input length comprises:

[0019] The target step length is obtained by the following formula:

[0020]

[0021] Among them, step is the target step size, length is the input length, e is a natural constant, n is the number of inputs, w is the preset scaling factor, b is the preset bias factor, The floor symbol.

[0022] The present invention also provides a preferred solution: the input interval prediction neural network includes an LSTM neural network and an RNN neural network connected in sequence, wherein the LSTM neural network is used to output a context vector based on the input character string, and the RNN neural network is used to take the context vector as input and output a predicted interval time vector corresponding to the input character string.

[0023] The present invention also provides a preferred solution: the LSTM neural network includes a primary input layer, an LSTM hidden layer and a primary output layer connected in sequence, and the LSTM hidden layer is also connected to the LSTM hidden layer itself for cyclic prediction; the primary input layer includes a plurality of primary input nodes, and the number of primary input nodes is equal to the number of encoding bits of a character; the primary output layer includes a plurality of primary output nodes, and each primary output node is used for an element in a context vector; the number of cycles of the LSTM neural network is equal to the input length, and the LSTM neural network outputs the context vector only after the last cycle;

[0024] The RNN neural network includes a secondary input layer, a RNN hidden layer and a secondary output layer connected in sequence, and the RNN hidden layer is also connected to the RNN hidden layer itself for loop prediction; the secondary input layer includes a plurality of secondary input nodes, each of which corresponds to an element in a context vector, and the plurality of secondary input nodes are respectively connected to a plurality of primary output nodes in a one-to-one correspondence; the RNN hidden layer performs calculations based on the input data of the secondary input node in each loop, and the number of loops of the RNN hidden layer is one less than the number of loops of the LSTM hidden layer; the secondary output layer includes a secondary output node, and the secondary output node outputs an element of an interval time vector in each loop.

[0025] The present invention also provides a preferred solution: the step of analyzing the input interval tolerance value of each character based on the identity information, the historical password and the historical input record includes:

[0026] Encode the identity information to obtain a coding vector corresponding to each identity information, and cluster the coding vectors to obtain multiple clusters;

[0027] Obtaining a first fault tolerance value according to the number of clusters;

[0028] According to the identity information, the historical passwords and the historical input records, a character variance table is obtained by analysis, wherein each entry of the character variance table includes a user ID representing a user, a character included in a historical password of the user, a variance of a preceding interval of the character in the historical input record corresponding to the historical password, a variance of a following interval of the character in the historical input record corresponding to the historical password, and the number of times the historical password is input;

[0029] According to the data in the character variance table, a second error tolerance value of each character is obtained;

[0030] The first error tolerance value and the second error tolerance value of each character are combined to obtain the input interval error tolerance value of each character.

[0031] The present invention also provides a preferred solution: the step of obtaining the second error tolerance value of each character according to the data in the character variance table comprises:

[0032] The second tolerance value of the target character is calculated by the following formula:

[0033]

[0034] Wherein, t2 is the second error tolerance value of the target character, c is the target character, i is the serial number of the entry corresponding to the target character c in the character variance table, and m is the total number of entries corresponding to the target character c in the character variance table. is the variance of the first interval in the entry where the i-th target character is located in the character variance table, is the variance of the back interval in the entry where the i-th target character is located in the character variance table, n c is the number of inputs in the entry where the i-th target character is located in the character variance table, and w2 is the preset weight parameter.

[0035] The present invention also provides a preferred solution: the user verification based on the trained input interval prediction neural network and the input interval tolerance value of each character includes:

[0036] Get the actual password entered by the user and the actual character input interval when entering the actual password;

[0037] Verify the actual password and obtain a first verification result;

[0038] Decompose the actual password into multiple actual character strings, and obtain an actual interval time vector corresponding to each actual character string according to the actual character input interval when inputting the actual password;

[0039] Input a plurality of actual character strings into the trained input interval prediction neural network model, and obtain a standard interval time vector corresponding to each actual character string output by the input interval prediction neural network;

[0040] Based on the input interval tolerance value of each character, and according to the standard interval time vector of each actual character string, verify the actual interval time vector of each actual character string to obtain a second verification result of each actual character string;

[0041] If the first verification result and the second verification results corresponding to all actual character strings are passed, the user verification is passed.

[0042] The present invention also provides a preferred solution: the input interval tolerance value based on each character is used to verify the actual interval time vector of each actual string according to the standard interval time vector of each actual string to obtain a second verification result of each actual string, including:

[0043] Get the element value corresponding to the interval between two target actual characters in the actual string in the actual interval time vector as the target value;

[0044] Obtain the element value corresponding to the interval between two target actual characters in the actual string in the standard interval time vector as the standard value;

[0045] Take the average value of the input interval tolerance values ​​corresponding to the two target actual characters to obtain the correction range value;

[0046] Based on the standard value, the standard interval is obtained according to the correction range value;

[0047] Determine whether the target value is within the standard interval. If so, the interval between the two target actual characters is compliant.

[0048] If the intervals between any two target actual characters in the actual character string are in compliance with the regulations, then the second verification result corresponding to the actual character string is determined to be passed.

[0049] The present invention also provides an information security analysis system based on big data, comprising:

[0050] A data acquisition module is used to acquire user input information big data, which includes each user's identity information, historical passwords and historical input records, and the historical input records include the character input interval corresponding to each time the historical password is input;

[0051] A data preparation module is used to establish a training set according to each historical password and historical input record, wherein the training set includes a plurality of data pairs, and the data pair includes a character string and an interval time vector corresponding to the character string;

[0052] A model training module is used to train an input interval prediction neural network based on a training set. The input interval prediction neural network is used to predict an interval time vector when a string is input;

[0053] A data analysis module is used to analyze and obtain the input interval tolerance value of each character based on identity information, historical passwords and historical input records;

[0054] The user verification module is used to verify the user based on the trained input interval prediction neural network and the input interval tolerance value of each character.

[0055] The beneficial effects of adopting the above embodiment are:

[0056] The present invention provides an information security analysis method and system based on big data. Compared with the prior art, the present invention trains an input interval prediction neural network through user input information big data, judges the interval time vector that a character string should have through the input interval prediction neural network, and uses the interval time vector to verify the user, so that the entire method has accuracy and universality based on big data. On this basis, the present invention also obtains the input interval tolerance value of each character through user input information big data analysis. The input interval tolerance value reflects the difference in the input of the same character by different users. In this way, the input interval tolerance value and the input interval prediction neural network can be combined to obtain a reasonable input interval range that includes individual differences, thereby achieving effective verification of users, greatly reducing the probability of misjudgment, and having good practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A method flow chart of the information security analysis method based on big data provided by the present invention;

[0058] Figure 2 for Figure 1 The method flow chart of step S102 in FIG.

[0059] Figure 3 It is a schematic diagram of the expansion of the input interval prediction neural network in the present invention on a time scale;

[0060] Figure 4 for Figure 1 The method flow chart of step S104;

[0061] Figure 5 for Figure 1 The method flow chart of step S105;

[0062] Figure 6 This is a system structure diagram of the big data-based information security analysis system provided by the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Combination Figure 1 As shown, a specific embodiment of the present invention discloses an information security analysis method based on big data, including:

[0065] S101, obtaining user input information big data, the user input information big data including each user's identity information, historical passwords and historical input records, the historical input records including the character input interval corresponding to each historical password input;

[0066] S102, establishing a training set according to each historical password and historical input record, the training set including a plurality of data pairs, the data pair including a character string and an interval time vector corresponding to the character string;

[0067] S103, training an input interval prediction neural network based on a training set, where the input interval prediction neural network is used to predict an interval time vector when a character string is input;

[0068] S104, analyzing and obtaining an input interval tolerance value of each character according to the identity information, historical passwords and historical input records;

[0069] S105: Verify the user based on the trained input interval prediction neural network and the input interval tolerance value of each character.

[0070] In the above process, the interval time vector is a vector composed of the time intervals corresponding to its character string. For example, if there is a character string "string", when the user inputs the character string, starting from pressing s, the character input intervals between every two English letters are: 0.2s, 0.3s, 0.2s, 0.4s, 0.4s, then the time interval vector corresponding to the character string can be [0.2, 0.3, 0.2, 0.4, 0.4].

[0071] Compared with the prior art, the present invention trains the input interval prediction neural network through user input information big data, judges the interval time vector that a character string should have through the input interval prediction neural network, and uses the interval time vector to verify the user, so that the entire method has accuracy and universality based on big data. On this basis, the present invention also obtains the input interval tolerance value of each character through the analysis of user input information big data. The input interval tolerance value reflects the difference of different users inputting the same character. In this way, the input interval tolerance value and the input interval prediction neural network can be combined to obtain a reasonable input interval range that includes individual differences, thereby realizing effective verification of users, greatly reducing the probability of misjudgment, and having good practicality.

[0072] Training the input interval prediction neural network requires a training set. At this time, the character string can be directly extracted from the historical password in the historical input record, and the corresponding character input interval and interval time vector can be established to obtain sufficient data pairs. The present invention also provides a more preferred method:

[0073] Further, combined with Figure 2As shown, in a preferred embodiment, the above step S102, based on each historical password and historical input record, establishes a training set, the training set includes a plurality of data pairs, the data pair includes a string and the interval time vector corresponding to the string, specifically including:

[0074] S201, obtaining a target historical password, a historical input record corresponding to the target historical password, and an input length of an input interval prediction neural network, wherein the target historical password is a historical password to be analyzed, and the unit of the input length is the number of characters;

[0075] S202, based on the historical input records, counting the number of inputs corresponding to the target historical password;

[0076] S203, obtaining a target step length according to the number of inputs and the input length;

[0077] S204, setting a sliding window on the historical target password, moving the sliding window based on the target step length and extracting characters in the sliding window to obtain multiple character strings, wherein the length of the sliding window is equal to the input length;

[0078] S205. According to the character input intervals in the historical input records corresponding to the target historical password, based on the multiple character strings, obtain the interval time vectors corresponding to the multiple character strings, and obtain the data pairs in the training set.

[0079] The significance of the above process is that, when establishing data pairs, the number of times each historical password is input is further considered. For a historical password, if it is input a large number of times, it means that the user is more familiar with the historical password, and the time interval between inputs is closer to the average input interval. At this time, the reference value of these historical input records is higher, and more data pairs should be decomposed for training.

[0080] Through the above method, multiple data pairs can be obtained from one historical input record, and the same historical password has multiple corresponding historical input records, so sufficient training data support can be obtained.

[0081] Specifically, in a preferred embodiment, the above step S203, obtaining the target step length according to the number of inputs and the input length, includes:

[0082] The target step length is obtained by the following formula:

[0083]

[0084] Among them, step is the target step size, length is the input length, e is a natural constant, n is the number of inputs, w is the preset scaling factor, b is the preset bias factor, The floor symbol.

[0085] The meaning of the above formula is that the more times the historical password is input, the smaller the moving step of the sliding window will be when extracting the string from the historical password. At this time, more strings can be extracted and more meaningful data pairs can be obtained, which improves the training accuracy. In addition, the above formula ensures that the final step length will not exceed the input length, and ensures that the extracted strings overlap, so as to improve the quality of the training set.

[0086] For example, taking the "string" in the previous article as an example, assuming it is a historical password, its corresponding time interval vector is [0.2, 0.3, 0.2, 0.4, 0.4]. Assuming the input length of the input interval prediction neural network is four characters, the sliding window is also 4 characters.

[0087] If the number of times the historical password is entered is large and the step length is 1, the data pairs that can be obtained through the above historical password are the following three:

[0088] "stri"-[0.2, 0.3, 0.2];

[0089] "trin"-[0.3, 0.2, 0.4];

[0090] "ring"-[0.2, 0.4, 0.4];

[0091] If the number of times the historical password is entered is large and the step length is 2, the data pairs that can be obtained through the above historical password are only the following two:

[0092] "stri"-[0.2, 0.3, 0.2];

[0093] "ring"-[0.2, 0.4, 0.4].

[0094] Furthermore, in a preferred embodiment, the input interval prediction neural network in the above step S103 includes an LSTM neural network and an RNN neural network connected in sequence, wherein the LSTM neural network is used to output a context vector based on the input character string, and the RNN neural network is used to take the context vector as input and output a predicted interval time vector corresponding to the input character string.

[0095] In practice, the intervals between characters input by users will be affected by the order of characters. For example, when using a full keyboard with one hand, the intervals between "Q" and "P" input by users will definitely be greater than the intervals between "O" and "P". Therefore, in this embodiment, LSTM neural networks and RNN neural networks are used to capture this sequence relationship, thereby outputting a more accurate predicted interval time vector. In addition, it can be seen from the previous examples that the lengths of the input data and output data of the input interval prediction neural network in this embodiment are inconsistent, that is, the length (number of elements) of the input time interval vector corresponding to the input string is always 1 less than the length (number of characters) of the string. Therefore, this embodiment connects two neural networks and uses context vectors as a bridge to achieve the conversion problem of variable-length sequences to sequences, thereby ensuring the accuracy of the results.

[0096] Specifically, in a preferred embodiment, the LSTM neural network includes a primary input layer, an LSTM hidden layer and a primary output layer connected in sequence, and the LSTM hidden layer is also connected to the LSTM hidden layer itself for cyclic prediction; the primary input layer includes a plurality of primary input nodes, and the number of primary input nodes is equal to the number of encoding bits of a character; the primary output layer includes a plurality of primary output nodes, and each primary output node is used for an element in the context vector; the number of cycles of the LSTM neural network is equal to the input length, and the LSTM neural network outputs the context vector only after the last cycle;

[0097] The RNN neural network includes a secondary input layer, a RNN hidden layer and a secondary output layer connected in sequence, and the RNN hidden layer is also connected to the RNN hidden layer itself for loop prediction; the secondary input layer includes a plurality of secondary input nodes, each of which corresponds to an element in a context vector, and the plurality of secondary input nodes are respectively connected to a plurality of primary output nodes in a one-to-one correspondence; the RNN hidden layer performs calculations based on the input data of the secondary input node in each loop, and the number of loops of the RNN hidden layer is one less than the number of loops of the LSTM hidden layer; the secondary output layer includes a secondary output node, and the secondary output node outputs an element of an interval time vector in each loop.

[0098] Figure 3 Schematic diagram of the expansion of the input interval prediction neural network on the time scale when the LSTM neural network loops 4 times and the RNN neural network loops 3 times.

[0099] The advantage of the input interval prediction neural network in this embodiment is that the number of primary input nodes in its primary input layer is equal to the number of encoding bits of a character, so that the characters in the input string can be directly input into this network (for example, the ASCII code of each character can be directly used for input) without the need to additionally encode the input data, thereby improving efficiency.

[0100] In addition, long short-term memory networks (LSTM) and recurrent neural networks (RNN) are two common sequence models used to process and predict time series data or other data with sequence properties. RNN is a basic form of sequence model that processes sequence data by cyclically connecting its own hidden layers, and can memorize previous information and apply it to current predictions. However, traditional RNNs have problems such as gradient disappearance and gradient explosion, which limit their performance on long sequences.

[0101] In contrast, LSTM solves the long-term dependency problem by introducing gating mechanisms (such as input gate, forget gate, and output gate). These gating units help the model better capture and utilize long-term dependencies. LSTM is therefore better at processing long sequences and long-term dependencies, and can more effectively process and predict time series data, such as speech recognition, text generation and other tasks.

[0102] LSTM has several significant advantages over traditional RNN: first, it can better handle long sequences and avoid the problem of gradient vanishing or gradient exploding; second, the gating mechanism of LSTM enables it to learn and remember long-term dependencies, which is particularly important in many practical applications; finally, LSTM can also better avoid local minima during training, which helps to improve the stability and efficiency of training.

[0103] Therefore, in this embodiment, the LSTM neural network with stronger sequence analysis ability is used as a way to analyze the input data, so that the obtained context vector can retain more sequence relationships to ensure the accuracy of the final output result. At the same time, this embodiment uses a relatively simple RNN neural network to analyze the context vector, thereby ensuring the operation speed and achieving the purpose of reducing the amount of data and lightweight. The combination of the above two networks achieves the effect of taking into account both accuracy and speed.

[0104] Further, combined with Figure 4 As shown, in a preferred embodiment, the above step S104, according to the identity information, the historical password and the historical input record, analyzes and obtains the input interval tolerance value of each character, specifically including:

[0105] S401, encoding the identity information to obtain a coding vector corresponding to each piece of identity information, and clustering the coding vectors to obtain multiple clusters;

[0106] S402, obtaining a first fault tolerance value according to the number of clusters;

[0107] S403, analyzing and obtaining a character variance table according to the identity information, the historical passwords and the historical input records, wherein each entry in the character variance table includes a user ID representing a user, a character included in a historical password of the user, a variance of a preceding interval of the character in the historical input record corresponding to the historical password, a variance of a following interval of the character in the historical input record corresponding to the historical password, and the number of times the historical password was input;

[0108] S404, obtaining a second error tolerance value for each character according to the data in the character variance table;

[0109] S405: Combine the first error tolerance value and the second error tolerance value of each character to obtain an input interval error tolerance value of each character.

[0110] In this embodiment, each identity information is first clustered, and the DBSCAN clustering algorithm can be used to obtain multiple clusters. If the number of clusters is larger, it means that the individual differences of users in the user input information big data are larger. At this time, the compatibility of the input interval prediction neural network trained by the user data information big data is higher. At this time, this compatibility can be reflected by the first fault tolerance value, and the interval standard for the final evaluation and verification is corrected on a small scale. On the contrary, if the number of clusters is smaller, it means that the individual differences of users are smaller. At this time, the compatibility of the input interval prediction neural network trained by the user data information big data is worse, and the interval standard for the final evaluation and verification should be corrected on a large scale. In practice, the first fault tolerance value can be determined in any way according to the specific situation, for example, by using a simple linear transformation to obtain the first fault tolerance value according to the number of clusters, and the first fault tolerance value and the number of clusters can be inversely proportional.

[0111] In addition, this embodiment uses a character variance table to count the input interval of each character in different passwords. The character variance table can be used to obtain the interval fluctuation of each character in a specific user and a specific password, thereby obtaining the fault tolerance rate of each character itself, and the fault tolerance rate is expressed as a second fault tolerance value. The following table is an example of a character variance table:

[0112]

[0113]

[0114] It can be seen from the above table that in the password entered by user A 55 times, the variance of the preceding interval (the time interval between the previous character and this character) and the variance of the following interval (the time interval between the next character and this character) of character t are both large, indicating that the interval of user A inputting this character has a high degree of fluctuation and the input is not very stable. In the password entered by user B 3 times, the variance of the preceding interval and the variance of the following interval of character t are both small, indicating that the interval of user B inputting this character has a low degree of fluctuation and the input is relatively stable. However, considering that the 55 times of user A is much greater than the 3 times of user B, the system should consider these two situations comprehensively and select a more average second fault tolerance value to characterize the input stability of character t, so as to make reasonable corrections to the interval standard of the final evaluation and verification.

[0115] Specifically, in a preferred embodiment, the above step S404, obtaining the second error tolerance value of each character according to the data in the character variance table, specifically includes:

[0116] The second tolerance value of the target character is calculated by the following formula:

[0117]

[0118] Wherein, t2 is the second error tolerance value of the target character, c is the target character, i is the serial number of the entry corresponding to the target character c in the character variance table, and m is the total number of entries corresponding to the target character c in the character variance table. is the variance of the first interval in the entry where the i-th target character is located in the character variance table, is the variance of the back interval in the entry where the i-th target character is located in the character variance table, n c is the number of inputs in the entry where the i-th target character is located in the character variance table, and w2 is the preset weight parameter.

[0119] The significance of the above formula is that, on the one hand, it takes into account the influence of the preceding and following intervals of a character, and on the other hand, it also takes into account the proportion of the number of times of entry and exit, thereby obtaining a more scientific and reasonable second fault tolerance value.

[0120] Further, in the above step S405, the input interval tolerance value of each character is obtained by combining the first tolerance value and the second tolerance value of each character. During implementation, the final input interval tolerance value can be calculated in any manner according to the specific situation, for example, the second tolerance value is compared with the first tolerance value, and then a linear change is performed to obtain an input interval tolerance value. In this embodiment, the first tolerance value is used to make the input interval tolerance value include the differences between different individuals, and the second tolerance value is used to make the input interval tolerance value include the influence of different characters themselves, thereby improving the final verification accuracy.

[0121] Further, combined with Figure 5 As shown, in a preferred embodiment, the above step S105, based on the trained input interval prediction neural network and the input interval tolerance value of each character, verifies the user, specifically including:

[0122] S501, obtaining the actual password input by the user and the actual character input interval when inputting the actual password;

[0123] S502, verifying the actual password to obtain a first verification result;

[0124] S503, decomposing the actual password into multiple actual character strings, and obtaining an actual interval time vector corresponding to each actual character string according to the actual character input interval when the actual password is input;

[0125] S504, inputting a plurality of actual character strings into the trained input interval prediction neural network model, and obtaining a standard interval time vector corresponding to each actual character string output by the input interval prediction neural network;

[0126] S505, based on the input interval tolerance value of each character and according to the standard interval time vector of each actual character string, verify the actual interval time vector of each actual character string to obtain a second verification result of each actual character string;

[0127] S506: If the first verification result and the second verification results corresponding to all actual character strings are both passed, the user verification is passed.

[0128] The above process combines the verification of the password itself and the verification of the input interval to ensure the accuracy of the verification result. At the same time, when verifying the input interval, it is corrected by the input interval tolerance value, which solves the problem that the interval verification technology in the prior art does not take into account the differences between individual users.

[0129] Further, in a preferred embodiment, the above step S505, based on the input interval tolerance value of each character, verifies the actual interval time vector of each actual character string according to the standard interval time vector of each actual character string to obtain the second verification result, specifically includes:

[0130] Get the element value corresponding to the interval between two target actual characters in the actual string in the actual interval time vector as the target value;

[0131] Obtain the element value corresponding to the interval between two target actual characters in the actual string in the standard interval time vector as the standard value;

[0132] Take the average value of the input interval tolerance values ​​corresponding to the two target actual characters to obtain the correction range value;

[0133] Based on the standard value, the standard interval is obtained according to the correction range value;

[0134] Determine whether the target value is within the standard interval. If so, the interval between the two target actual characters is compliant.

[0135] If the intervals between any two target actual characters in the actual character string are in compliance with the regulations, then the second verification result corresponding to the actual character string is determined to be passed.

[0136] For example, in the string "string", the interval between the letters t and r is 0.3. If the input interval tolerance value corresponding to the letter t is 0.12, and the input interval tolerance value corresponding to the letter r is 0.08, then the correction range value can be 0.1, and then the standard interval can be 0.25-0.35. At this time, if the interval between the input letters t and r is within this interval when "string" is actually input, then the interval is compliant. If all intervals in "string" are compliant, then the second verification result of the string is passed.

[0137] Combination Figure 6 As shown, the present invention also provides an information security analysis system based on big data, comprising:

[0138] The data acquisition module 610 is used to acquire user input information big data, the user input information big data includes each user's identity information, historical passwords and historical input records, the historical input records include the character input interval corresponding to each time the historical password is input;

[0139] A data preparation module 620 is used to establish a training set according to each historical password and historical input record, wherein the training set includes a plurality of data pairs, and the data pair includes a character string and an interval time vector corresponding to the character string;

[0140] A model training module 630, used for training an input interval prediction neural network based on a training set, where the input interval prediction neural network is used for predicting an interval time vector when a character string is input;

[0141] The data analysis module 640 is used to analyze and obtain the input interval tolerance value of each character according to the identity information, historical passwords and historical input records;

[0142] The user verification module 650 is used to verify the user based on the trained input interval prediction neural network and the input interval tolerance value of each character.

[0143] It should be noted here that the corresponding system provided in the above embodiments can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can be found in the corresponding contents in the above method embodiments, which will not be repeated here.

[0144] The present invention provides an information security analysis method and system based on big data. Compared with the prior art, the present invention trains an input interval prediction neural network through user input information big data, judges the interval time vector that a character string should have through the input interval prediction neural network, and uses the interval time vector to verify the user, so that the entire method has accuracy and universality based on big data. On this basis, the present invention also obtains the input interval tolerance value of each character through user input information big data analysis. The input interval tolerance value reflects the difference in the input of the same character by different users. In this way, the input interval tolerance value and the input interval prediction neural network can be combined to obtain a reasonable input interval range that includes individual differences, thereby achieving effective verification of users, greatly reducing the probability of misjudgment, and having good practicality.

[0145] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0146] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for information security analysis based on big data, characterized in that: include: Obtaining user input information big data, the user input information big data includes each user's identity information, historical passwords and historical input records, the historical input records include the character input interval corresponding to each time the historical password is input; According to each historical password and historical input record, a training set is established, wherein the training set includes a plurality of data pairs, wherein the data pair includes a character string and an interval time vector corresponding to the character string; Based on the training set, the input interval prediction neural network is trained to predict the interval time vector of a string input; According to the identity information, historical passwords and historical input records, the input interval tolerance value of each character is analyzed; Verify the user based on the trained input interval prediction neural network and the input interval tolerance value of each character; Among them, according to the identity information, historical passwords and historical input records, the input interval tolerance value of each character is analyzed and obtained, including: Encode the identity information to obtain a coding vector corresponding to each identity information, and cluster the coding vectors to obtain multiple clusters; Obtaining a first fault tolerance value according to the number of clusters; According to the identity information, the historical passwords and the historical input records, a character variance table is obtained by analysis, wherein each entry of the character variance table includes a user ID representing a user, a character included in a historical password of the user, a variance of a preceding interval of the character in the historical input record corresponding to the historical password, a variance of a following interval of the character in the historical input record corresponding to the historical password, and the number of times the historical password is input; According to the data in the character variance table, a second error tolerance value of each character is obtained; Combining the first error tolerance value with the second error tolerance value of each character, obtaining an input interval error tolerance value of each character; Wherein, according to the data in the character variance table, the second error tolerance value of each character is obtained, including: The second tolerance value of the target character is calculated by the following formula: ； in, is the second tolerance value of the target character, is the target character, is the target character in the character variance table The ordinal number of the corresponding entry, is the target character in the character variance table The total number of corresponding entries, is the character variance table, The variance of the preceding interval in the entry where the target character is located, is the character variance table, The variance of the back interval in the entry where the target character is located, is the character variance table, The number of times the target character is entered in the entry, is the preset weight parameter.

2. The information security analysis method based on big data according to claim 1 is characterized in that: The training set is established according to each historical password and historical input record, including: Obtaining a target historical password, a historical input record corresponding to the target historical password, and an input length of an input interval prediction neural network, wherein the target historical password is the current historical password to be analyzed, and the unit of the input length is the number of characters; Based on the historical input records, count the number of inputs corresponding to the target historical password; According to the number of inputs and the input length, the target step length is obtained; A sliding window is set on the historical target password, the sliding window is moved based on the target step length, and characters in the sliding window are extracted to obtain multiple character strings, wherein the length of the sliding window is equal to the input length; According to the character input interval in the historical input record corresponding to the target historical password, based on multiple character strings, the interval time vectors corresponding to the multiple character strings are obtained, and the data pairs in the training set are obtained.

3. The information security analysis method based on big data according to claim 2 is characterized in that: The target step length is obtained according to the number of inputs and the input length, including: The target step length is obtained by the following formula: ； in, is the target step length, is the input length, is a natural constant, is the number of inputs, is the preset zoom factor, is the preset bias coefficient, The floor symbol.

4. The information security analysis method based on big data according to claim 2 is characterized in that: The input interval prediction neural network includes an LSTM neural network and a RNN neural network connected in sequence, wherein the LSTM neural network is used to output a context vector according to an input character string, and the RNN neural network is used to take the context vector as input and output a predicted interval time vector corresponding to the input character string.

5. The information security analysis method based on big data according to claim 4 is characterized in that: The LSTM neural network includes a primary input layer, an LSTM hidden layer and a primary output layer connected in sequence, and the LSTM hidden layer is also connected to the LSTM hidden layer itself for cyclic prediction; the primary input layer includes a plurality of primary input nodes, and the number of primary input nodes is equal to the number of encoding bits of a character; the primary output layer includes a plurality of primary output nodes, and each primary output node is used for an element in the context vector; the number of cycles of the LSTM neural network is equal to the input length, and the LSTM neural network outputs the context vector only after the last cycle; The RNN neural network includes a secondary input layer, a RNN hidden layer and a secondary output layer connected in sequence, and the RNN hidden layer is also connected to the RNN hidden layer itself for loop prediction; the secondary input layer includes a plurality of secondary input nodes, each of which corresponds to an element in the context vector, and the plurality of secondary input nodes are respectively connected to the plurality of primary output nodes in a one-to-one correspondence; The RNN hidden layer performs calculations based on the input data of the secondary input node in each cycle, and the number of cycles of the RNN hidden layer is one less than that of the LSTM hidden layer; the secondary output layer includes a secondary output node, and the secondary output node outputs an element of the interval time vector in each cycle.

6. The information security analysis method based on big data according to claim 1 is characterized in that: The user verification based on the trained input interval prediction neural network and the input interval tolerance value of each character includes: Get the actual password entered by the user and the actual character input interval when entering the actual password; Verify the actual password and obtain a first verification result; Decompose the actual password into multiple actual character strings, and obtain an actual interval time vector corresponding to each actual character string according to the actual character input interval when inputting the actual password; Input a plurality of actual character strings into the trained input interval prediction neural network model, and obtain a standard interval time vector corresponding to each actual character string output by the input interval prediction neural network; Based on the input interval tolerance value of each character, and according to the standard interval time vector of each actual character string, verify the actual interval time vector of each actual character string to obtain a second verification result of each actual character string; If the first verification result and the second verification results corresponding to all actual character strings are passed, the user verification is passed.

7. The information security analysis method based on big data according to claim 6 is characterized in that: The step of verifying the actual time interval vector of each actual character string based on the input interval tolerance value of each character and the standard time interval vector of each actual character string to obtain a second verification result of each actual character string includes: Get the element value corresponding to the interval between two target actual characters in the actual string in the actual interval time vector as the target value; Obtain the element value corresponding to the interval between two target actual characters in the actual string in the standard interval time vector as the standard value; Take the average value of the input interval tolerance values ​​corresponding to the two target actual characters to obtain the correction range value; Based on the standard value, the standard interval is obtained according to the correction range value; Determine whether the target value is within the standard interval. If so, the interval between the two target actual characters is compliant. If the intervals between any two target actual characters in the actual character string are compliant, then the second verification result corresponding to the actual character string is determined to be passed.

8. An information security analysis system based on big data, characterized in that: include: A data acquisition module is used to acquire user input information big data, which includes each user's identity information, historical passwords and historical input records, and the historical input records include the character input interval corresponding to each time the historical password is input; A data preparation module is used to establish a training set according to each historical password and historical input record, wherein the training set includes a plurality of data pairs, and the data pair includes a character string and an interval time vector corresponding to the character string; A model training module is used to train an input interval prediction neural network based on a training set. The input interval prediction neural network is used to predict an interval time vector when a string is input; A data analysis module is used to analyze and obtain the input interval tolerance value of each character based on identity information, historical passwords and historical input records; A user verification module is used to verify the user based on the trained input interval prediction neural network and the input interval tolerance value of each character; Among them, according to the identity information, historical passwords and historical input records, the input interval tolerance value of each character is analyzed and obtained, including: Encode the identity information to obtain a coding vector corresponding to each identity information, and cluster the coding vectors to obtain multiple clusters; Obtaining a first fault tolerance value according to the number of clusters; According to the identity information, the historical passwords and the historical input records, a character variance table is obtained by analysis, wherein each entry of the character variance table includes a user ID representing a user, a character included in a historical password of the user, a variance of a preceding interval of the character in the historical input record corresponding to the historical password, a variance of a following interval of the character in the historical input record corresponding to the historical password, and the number of times the historical password is input; According to the data in the character variance table, a second error tolerance value of each character is obtained; Combining the first error tolerance value with the second error tolerance value of each character, obtaining an input interval error tolerance value of each character; Wherein, according to the data in the character variance table, the second error tolerance value of each character is obtained, including: The second tolerance value of the target character is calculated by the following formula: ； in, is the second tolerance value of the target character, is the target character, is the target character in the character variance table The ordinal number of the corresponding entry, is the target character in the character variance table The total number of corresponding entries, is the character variance table, The variance of the preceding interval in the entry where the target character is located, is the character variance table, The variance of the back interval in the entry where the target character is located, is the character variance table, The number of times the target character is entered in the entry, is the preset weight parameter.

Images