Digital asset security custody system and method based on big data

Abstract

The present invention discloses a digital asset security custody system and method based on big data, and relates to the field of digital security technology; the present invention extracts features of historical login behaviors of users with the help of big data, obtains user behavior feature parameters, can accurately reflect the regularity, activity level and habitual characteristics of users' login behaviors, helps to analyze users' behavior patterns and risk situations, and provides support for the generation of security custody strategies; by analyzing users' login behavior information, combining set weight coefficients and regularity thresholds, calculating the risk value of user login, and triggering security custody strategies of different authority levels according to the size of the risk value, abnormal behaviors can be discovered in time, the ability to identify potential risks is improved, and more reliable protection is provided for users' data assets.

Description

Technical Field

[0001] The present invention relates to the field of digital security technology, and in particular to a digital asset security custody system and method based on big data. Background Art

[0002] With the rapid development of online and mobile payments, and the increasing use of digital assets such as cryptocurrencies and digital securities in personal and institutional investment and transactions, the security and credibility of digital assets have become important concerns;

[0003] Current digital asset security custody usually adopts specific security verification mechanisms, such as passwords, two-factor authentication, etc., to protect users' digital assets from unauthorized access. Once hackers overcome these security verification mechanisms, they may obtain unlimited access to digital assets and perform any operations, including transferring assets, stealing assets and other malicious behaviors; thereby increasing the risk of digital assets. Summary of the invention

[0004] The main purpose of the present invention is to provide a digital asset security custody system and system based on big data to overcome the problems mentioned in the above background technology.

[0005] To achieve the above object, according to one aspect of the present invention, a digital asset security custody system based on big data is provided, the system comprising: a server, a data identification module and a security custody module;

[0006] The server stores the user's historical login behavior information, including the number of historical login behaviors and the login start time, login end time, and login address of each historical login behavior;

[0007] The data identification module identifies the user's behavior characteristics based on the user's historical login information to obtain the user's behavior characteristic parameters, wherein the behavior characteristic parameters include a login index, a cumulative regularity value, a cumulative habit index in each time period, and an influence value corresponding to each login address;

[0008] The security hosting module conducts risk assessment of user login behavior based on the user's behavioral characteristic parameters to generate the corresponding security hosting strategy; the specific process is as follows:

[0009] When a user successfully logs in to the digital asset network, the user's behavior characteristic parameters are retrieved and the user's login behavior information is obtained, where the login behavior information includes the user's login address and login time; the login time is compared with each time period to match the corresponding cumulative habit index, recorded as Fb, and the largest cumulative habit index and the smallest cumulative habit index are selected in each time period, and recorded as Fbmax and Fbmin respectively; the login address is compared with various login addresses to match the corresponding influence value, recorded as Yb; the set formula is used to form Perform calculations

[0010] Get the risk value FY of the user's login, where a1, a2, a3, a4, a5, and a6 are the set weight coefficients and U1 is the rule threshold set;

[0011] When the risk value is greater than or equal to the maximum value in the set risk range, communication verification is triggered. If the communication verification fails, the user account is locked and enters the locked state. If the communication verification passes, the user account is controlled to enter the display state. When the risk value is within the set risk range, the user account is controlled to enter the display state. When the risk value is less than the minimum value in the set risk range, the user account is controlled to enter the unrestricted state. The locked state, display state and unrestricted state are all security hosting strategies.

[0012] Furthermore, the communication verification process is as follows:

[0013] Step 1: Retrieve the same historical login address as the current login address from the historical login addresses, and select any historical login address with an unrestricted hosting policy from them, and record the historical login address as the target address;

[0014] Step 2: retrieve the login address type corresponding to the current login behavior of the user account, and extract the corresponding historical login time from the login address of this type; sort the historical login times in order to obtain a login numerical sequence; identify the position of "0" in the login numerical sequence and record it as a random position; randomly fill the numbers "1-9" at the random position; use the random position as a graphic node to divide the login numerical sequence after random filling into several numerical segments, compare and analyze the numerical quantity of the numerical segment with the set numerical interval to match the corresponding value; divide each numerical segment by the matched value to obtain the segment diameter, draw a horizontal line, draw the center of the circle on the horizontal line, and draw a circle with the segment diameter as the diameter to obtain the circle corresponding to each numerical segment, and arrange each circle in the order of the numerical segment to which it belongs in the login numerical sequence and in a tangent manner to obtain the communication graph corresponding to the login address of this type; divide the communication graph into two along the horizontal line, the upper half is used as a verification graph and sent to the target address, and the lower half is sent to the server as a comparison graph for storage;

[0015] Step 3: Integrate the verification pattern into a communication verification request and send it to the target address. When the verification pattern sent by the target address is received, it is compared with the corresponding comparison pattern. If they match, the communication verification is passed, otherwise the communication verification fails.

[0016] Furthermore, the feature identification process of the user login behavior is specifically as follows:

[0017] 301: Retrieve the login start time and login end time of the user, and calculate the time difference between the two to obtain the single login duration; number the single login durations in sequence according to the login time of the corresponding login behavior, and construct a single login duration change curve chart with the number as the horizontal axis and the single login duration as the vertical axis; thereby, perform in-depth analysis on the single login duration change curve chart to obtain a login index;

[0018] 302: Calculate the time difference between the login end time corresponding to the previous login behavior and the login start time of the next login behavior in adjacent login behaviors to obtain the login interval time between any two login behaviors; number the login interval time according to the login time of the corresponding login behavior; obtain a login interval time change curve graph with the number as the horizontal axis and the login interval time as the vertical axis, and perform graphical analysis on the login interval time change curve graph to obtain a cumulative regularity value;

[0019] 303: Divide each day into several time periods based on the day as a unit; distribute historical login behaviors into several time periods according to the corresponding login start time and login end time, and perform cumulative analysis on the time periods to obtain the cumulative habit index in each time period;

[0020] 304: Retrieve the user's historical login addresses and corresponding historical login times, and classify and analyze all historical login addresses according to the login addresses to obtain the impact values ​​corresponding to each type of login address.

[0021] Furthermore, the specific process of conducting in-depth analysis on the single login duration change curve to obtain the login index is as follows:

[0022] Draw tangents of the curve at interval points in the curve, and calculate the slope of the tangent to obtain the slope corresponding to each interval point and record it as Fi, where i = 1, 2, 3 ... I, I is a positive integer, I represents the maximum number in the numbering, and i represents any number among them; the slope greater than zero is recorded as the increasing slope, and the slope less than zero is processed by taking the absolute value and recorded as the decreasing slope; compare and analyze the increasing slope with the set increasing range to obtain the first-level increasing slope, the second-level increasing slope and the third-level increasing slope;

[0023] Compare and analyze the decline slope with the decline range to divide the decline slope into the first-level decline slope, the second-level decline slope and the third-level decline slope; count the number of the first-level increase slope, the second-level increase slope and the third-level increase slope respectively, and record them as X1, X2 and X3 respectively; sum the first-level increase slope, the second-level increase slope and the third-level increase slope to obtain the first-level increase value, the second-level increase value and the third-level increase value, and record them as X4, X5 and X6 respectively;

[0024] When the increasing slope is greater than the maximum value in the set increasing range, the increasing slope is recorded as the first-level increasing slope; when the increasing slope is within the set increasing range, the increasing slope is recorded as the second-level increasing slope; when the increasing slope is less than the minimum value in the set increasing range, the increasing slope is recorded as the third-level increasing slope; the number of the first-level decreasing slope, the second-level decreasing slope and the third-level decreasing slope are counted respectively, and they are recorded as P1, P2 and P3 respectively; the first-level decreasing slope, the second-level decreasing slope and the third-level decreasing slope are summed to obtain the first-level decreasing value, the second-level decreasing value and the third-level decreasing value, and they are recorded as P4, P5 and P6 respectively;

[0025] X1, X2, X3, X4, X5, X6, P1, P2, P3, P4, P5 and P6 are set by the formula The login index DP is calculated, where q1, q2, q3, q4, q5, and q6 are set weight coefficients, and e is a natural constant.

[0026] Furthermore, the specific process of performing graphical analysis on the login interval duration change curve is as follows:

[0027] Draw a tangent line of the curve at the interval point, use data fitting to get the tangent expression, and perform differentiation operation on the tangent expression to get the tangent derivative at each interval point, recorded as Ki, where i = 1, 2, 3 ... I, I is a positive integer, I represents the largest number in the numbering, and i represents any number among them; sum up the derivatives greater than zero to get the interval increase, recorded as G1, sum up the derivatives less than zero and take the absolute value to get the interval decrease, recorded as G2; use the set formula The cumulative regularity value GK is calculated, where b1, b2, and b3 are the set weight coefficients. It represents the mean value of the derivative at each interval point. It represents the mean slope of each login point.

[0028] Furthermore, the specific process of the cumulative analysis of the time period is as follows:

[0029] Take any time period, count the cumulative number of logins in the time period as F1, and sum up the login durations corresponding to the cumulative number of logins in the time period to obtain the cumulative login duration as F2; ​​substitute the cumulative number of logins F1 and the cumulative login duration F2 in each time period into the set formula Fb=b4×F1+b5×F2 to calculate to obtain the cumulative habit index Fb in each time period, where b4 and b5 are the set weight coefficients respectively;

[0030] Retrieve the user's historical login addresses and the corresponding historical login times, and classify all historical login addresses according to the login addresses; randomly select one category of login addresses, the historical login addresses and the corresponding historical login times in this category of login addresses, calculate the time difference between the historical login time and the current time of the system as the influencing factor of the historical login address, and calculate the average as the influencing factor of the category of login addresses, record it as Y3; count the number of historical login addresses in the same category, record it as Y4, substitute Y3 and Y4 into the set formula Yb=b6×(1 / Y1)+b7×Y2 to calculate the influence value Yb corresponding to each category of login addresses, where b6 and b7 are the set weight coefficients respectively.

[0031] In order to achieve the above object, according to another aspect of the present invention, a digital asset security custody method based on big data is provided, the method comprising the following steps:

[0032] 701: Retrieve the login start time and login end time of the user, and calculate the time difference between the two to obtain the single login duration; number the single login durations in sequence according to the login time of the corresponding login behavior, and construct a single login duration change curve chart with the number as the horizontal axis and the single login duration as the vertical axis; thereby, perform in-depth analysis on the single login duration change curve chart to obtain a login index;

[0033] 702: Calculate the time difference between the login end time corresponding to the previous login behavior and the login start time of the next login behavior in adjacent login behaviors to obtain the login interval time between any two login behaviors; number the login interval time according to the login time of the corresponding login behavior; obtain a login interval time change curve graph with the number as the horizontal axis and the login interval time as the vertical axis, and perform graphical analysis on the login interval time change curve graph to obtain a cumulative regularity value;

[0034] 703: Taking a day as a unit, divide each day into several time periods; distribute historical login behaviors into several time periods according to corresponding login start time and login end time, and make cumulative analysis of the time periods to obtain the cumulative habit index in each time period;

[0035] 704: Retrieve the historical login addresses and corresponding historical login times of the user, and classify and analyze all historical login addresses according to the login addresses to obtain the influence values ​​corresponding to each login address; record the login index, the cumulative regularity value, the cumulative habit index in each time period, and the influence value corresponding to each login address as the user's behavior characteristic parameters;

[0036] 705: Perform risk assessment on the user's login behavior based on the user's behavior characteristic parameters to generate a corresponding security trusteeship policy; the specific process is as follows:

[0037] When a user successfully logs in to the digital asset network, the user's behavior characteristic parameters are retrieved and the user's login behavior information is obtained, and then numerically analyzed to obtain the risk value of this login;

[0038] When the risk value is greater than or equal to the maximum value in the set risk interval, communication verification is triggered. If the communication verification fails, the user account is locked and enters the locked state. If the communication verification passes, the user account is controlled to enter the display state. When the risk value is within the set risk interval, the user account is controlled to enter the display state. When the risk value is less than the minimum value in the set risk interval, the user account is controlled to enter the unrestricted state, among which the locked state, display state and unrestricted state are all managed policies.

[0039] Beneficial effects of the present invention:

[0040] The present invention extracts features of the user's historical login behavior with the help of big data, and obtains user behavior feature parameters, which can accurately reflect the user's login behavior rules, activity level and habit characteristics, help analyze the user's behavior pattern and risk situation, and provide support for the generation of security hosting strategies;

[0041] The present invention analyzes the user's login behavior information, combines the set weight coefficient and regularity threshold, calculates the risk value of the user's login, and triggers security hosting policies of different authority levels according to the size of the risk value, so as to timely discover abnormal behavior and improve the ability to identify potential risks. Compared with traditional security verification mechanisms, two-factor identity authentication, etc., this risk assessment based on user behavior characteristics can personalize the security policy and effectively improve the security of digital assets, reduce the risks brought by unauthorized access and malicious operations, and provide more reliable protection for users' data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0043] Figure 1 It is a schematic diagram of system module connection of the present invention. DETAILED DESCRIPTION

[0044] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0045] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0046] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0047] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0048] According to an embodiment of the present invention, Figure 1 As shown, a digital asset security custody system based on big data is provided, the system includes: a server, a data identification module and a security custody module;

[0049] The server stores the user's historical login behavior information, including the number of historical login behaviors and the login start time, login end time, and login address of each historical login behavior;

[0050] The data identification module extracts the characteristics of the user's historical login behavior to obtain the behavior characteristic parameters related to the user. The specific steps of behavior characteristic extraction are:

[0051] Step 1: retrieve the user's historical login behavior information, calculate the time difference between the login start time and the login end time to obtain the single login duration; thus, all single login durations of historical login behaviors can be obtained, and the single login durations are sorted and numbered in chronological order according to the login time (login start time and login end time) of their corresponding login behaviors, thereby obtaining the number of any single login duration; construct a two-dimensional rectangular coordinate system with the number as the horizontal coordinate and the single login duration as the vertical coordinate, and input the single login duration into the coordinate system according to the corresponding number; record the position of the single login duration in the coordinate system as the login point, and use a smooth curve to connect the login points in sequence to obtain a curve chart of the login interval changing with time; draw a tangent to the curve at the interval point in the curve, and calculate the tangent slope to obtain the slope corresponding to each interval point, recorded as Fi, where i = 1, 2, 3...I, I is a positive integer, and I represents The maximum number among the numbers is indicated, and i indicates any one of the numbers; a slope greater than zero is recorded as an increase slope, and a slope less than zero is recorded as a decrease slope after taking the absolute value; the increase slope is compared and analyzed with the set increase range, and when the increase slope is greater than the maximum value in the set increase range, the increase slope is recorded as a first-level increase slope; when the increase slope is within the set increase range, the increase slope is recorded as a second-level increase slope; when the increase slope is less than the minimum value in the set increase range, the increase slope is recorded as a third-level increase slope; the number of first-level increase slopes, second-level increase slopes and third-level increase slopes are counted respectively, and they are recorded as X1, X2 and X3 respectively; the first-level increase slope, the second-level increase slope and the third-level increase slope are summed and calculated to obtain the first-level increase value, the second-level increase value and the third-level increase value, and they are recorded as X4, X5 and X6 respectively;

[0052] Compare and analyze the decline slope with the decline range. When the decline slope is greater than the maximum value in the set decline range, the decline slope is recorded as the first-level decline slope; when the decline slope is within the set decline range, the decline slope is recorded as the second-level decline slope; when the decline slope is less than the minimum value in the set decline range, the decline slope is recorded as the third-level decline slope; count the number of first-level decline slopes, second-level decline slopes and third-level decline slopes respectively, and record them as P1, P2 and P3 respectively; sum the first-level decline slopes, second-level decline slopes and third-level decline slopes to obtain the first-level decline value, second-level decline value and third-level decline value, and record them as P4, P5 and P6 respectively; use the set formula The login index DP is calculated, where q1, q2, q3, q4, q5, and q6 are respectively the set weight coefficients, and e is a natural constant. It should be noted that when the single login duration of a user increases, the login index is larger; on the contrary, when the single login duration of a user decreases, the login index is smaller.

[0053] Step 2: Calculate the time difference between the corresponding login end time of the previous login behavior and the login start time of the next login behavior in adjacent login behaviors to obtain the login interval time of any two login behaviors; number the login interval time according to the login time (login start time and login end time) of the corresponding login behavior, thereby obtaining the number of each login interval time; construct a two-dimensional rectangular coordinate system with the number as the horizontal coordinate and the login interval time as the vertical coordinate, input the login interval time into the coordinate system according to its corresponding number, and record the position of the login interval time in the coordinate system as the interval point, and use a smooth curve to connect the interval points in sequence to obtain a login interval time change curve; draw a tangent to the curve at the position of the interval point, use data fitting to obtain the tangent expression, and derive the tangent point expression to obtain the tangent derivative at each interval point, which is recorded as Ki; sum the derivatives greater than zero to obtain the interval increase, which is recorded as G1, and sum the derivatives less than zero and take the absolute value to calculate the interval decrease, which is recorded as G2; use the set formula The cumulative regularity value GK is calculated, where b1, b2, and b3 are the set weight coefficients. It represents the mean value of the derivative at each interval point. It represents the mean slope of each login point. It should be noted that when the user's login interval is more average, it means that the user's login behavior is more regular, and the cumulative regularity value is larger;

[0054] Step 3: Taking days as units, divide each day into several time periods; distribute historical login behaviors into several time periods according to the corresponding login start time and login end time, thereby obtaining the number of login behaviors in each time period and the login duration corresponding to each login behavior. Randomly select a time period, count the cumulative number of logins in the time period as F1, and sum up the login duration corresponding to each cumulative number of logins in the time period to obtain the cumulative login duration as F2; ​​specifically, there are time periods (8:00, 10:00], (10:00, 12:00] and (12:00, 14:00], in which there is any historical login behavior (login start time 9:00 to login end time 11:00), and the result of matching the historical login behavior to the time period is that the time period (8:00, 10:00] accumulates one login behavior, and the cumulative login duration corresponding to the accumulated login behavior is 1h; the time period (10:00, 12:00] accumulates one login behavior, and the login duration corresponding to the accumulated login behavior is 1h;

[0055] The cumulative number of logins F1 and the cumulative login duration F2 in each time period are calculated using the set formula Fb=b4×F1+b5×F2 to obtain the cumulative habit index Fb in each time period, where b4 and b5 are the set weight coefficients respectively;

[0056] Step 4: retrieve the user's historical login addresses and the corresponding historical login times, and classify all historical login addresses according to the login addresses, where the same login address is one category, thereby all historical login addresses can be divided into several categories; randomly select one category of login addresses, the historical login addresses and the corresponding historical login times in this category of login addresses, calculate the time difference between the historical login time and the current time of the system to obtain the time difference as the impact factor of the historical login address, thereby obtaining the impact factor of each historical login address in the same category, and calculate the average value obtained by the average calculation as the impact factor of the login address in this category and record it as Y3; count the number of each historical login address in the same category and record it as Y4, and use the set formula Yb=b6×(1 / Y1)+b7×Y2 to calculate the impact value Yb corresponding to each type of login address, where b6 and b7 are the set weight coefficients respectively;

[0057] The login index DP, the cumulative regularity value GK, the cumulative habit index in each time period, and the influence value corresponding to each login address are recorded as the user's behavior characteristic parameters, and the behavior characteristic parameters are sent to the security hosting module;

[0058] By using big data to extract features from users' historical login behaviors, we obtained user behavior feature parameters, which can accurately reflect the users' login behavior patterns, activity levels, and habitual characteristics, help analyze users' behavior patterns and risk situations, and provide support for the generation of security hosting strategies.

[0059] The security trust module conducts risk assessment on the user's characteristic behavior based on the behavioral characteristic parameters to generate corresponding security trust strategies to further protect the user's data assets; the specific steps of risk assessment are:

[0060] When a user successfully logs in to the digital asset network, the user's behavior characteristic parameters are retrieved and the user's login behavior information is obtained, where the login behavior information includes the user's login address and login time; the login time is compared with each time period to match the corresponding cumulative habit index Fb, and the largest cumulative habit index and the smallest cumulative habit index are selected in each time period, and they are recorded as Fbmax and Fbmin respectively; the login address is compared with various login addresses to match the corresponding influence value Yb; the set formula is used to form Calculate and obtain the risk value FY of the user's login this time, where a1, a2, a3, a4, a5, and a6 are the set weight coefficients respectively, and U1 is the regular threshold set; compare and analyze the risk value with the set risk interval. When the risk value is greater than or equal to the maximum value in the set risk interval, it means that the user's login this time has a relatively large security risk, and then the communication verification is triggered. If the communication verification fails, the user account is locked and enters a locked state (no display authority and operation authority). It should be noted that the locked state means that the user cannot operate or display any item in his digital asset account; if the communication verification passes, the user account is controlled to enter a display state, that is, only display authority but no operation authority; when the risk value is within the set risk interval, it means that the user's account has a slight security risk, and the user account is controlled to enter a display state; when the risk value is less than the minimum value in the set risk interval, the user account is controlled to enter an unrestricted state, that is, it has both display authority and operation authority; the locked state, display state, and unrestricted state are all escrow policies;

[0061] The specific steps of communication verification are:

[0062] Step 1: retrieve the same historical login address as the current login address from the historical login addresses, select the historical login address with an unrestricted hosting policy, and record the historical login address as the target address. Select the historical login address consistent with the current login address from the historical login behavior as the target address for communication, which can prevent spoofing addresses and ensure communication with the user end;

[0063] Step 2: retrieve the login address type corresponding to the current login behavior of the user account, and extract the corresponding historical login time from the login address of this type (the number of times the user logs in using this type of login is the number of corresponding historical login times); sort the historical login times in order to obtain a login numerical sequence; identify the position of "0" in the login numerical sequence, and record it as a random position; randomly fill in the numbers "1-9" at the random position, so that the login numerical sequence after random filling does not include the existence of "0"; use random positions as graphic nodes to divide the login numerical sequence after random filling into several numerical segments, compare and analyze the number of numerical segments with the set numerical interval, and when the number of numerical segments is greater than the maximum value in the set numerical interval , then the value of V1 is matched; when the number of values ​​of the value fragment is within the set number interval, the value of V2 is matched; when the number of values ​​of the value fragment is less than the minimum value in the set number interval, the value of V3 is matched, where V1>V2>V3; each value fragment is divided by the matched value to obtain the fragment diameter, a horizontal line is drawn, the center of the circle is drawn on the horizontal line, and a circle is drawn with the fragment diameter as the diameter to obtain the circle corresponding to each value fragment, and each circle is arranged in the order of the value fragment to which it belongs in the login value sequence and in a tangent manner to obtain the communication graph corresponding to the login address of this type; the communication graph is divided into two parts along the horizontal line, the upper half is used as a verification graph and sent to the target address, and the lower half is sent to the server as a comparison graph for storage;

[0064] Step 3: Integrate the verification pattern into a communication verification request and send it to the target address. When the verification pattern sent by the target address is received, it is compared with the corresponding comparison pattern. If they match, the communication verification is passed, otherwise the communication verification fails.

[0065] By analyzing the user's login behavior information, combining the set weight coefficient and regularity threshold, calculating the risk value of the user's login, and triggering security hosting policies of different authority levels according to the size of the risk value, it is possible to detect abnormal behavior in a timely manner and improve the ability to identify potential risks. Compared with traditional security verification mechanisms, two-factor authentication, etc., this risk assessment based on user behavior characteristics can be used to personalize security policies, effectively improve the security of digital assets, reduce the risks brought by unauthorized access and malicious operations, and provide more reliable protection for users' data assets.

[0066] According to an embodiment of the present invention, a digital asset security custody method based on big data is also provided, and the method comprises the following steps:

[0067] T1: retrieve the user's login start time and login end time, and calculate the time difference between the two to obtain the single login duration; number the single login durations in sequence according to the login time of the corresponding login behavior, and construct a single login duration change curve chart with the number as the horizontal axis and the single login duration as the vertical axis; thereby, conduct in-depth analysis on the single login duration change curve chart to obtain the login index;

[0068] T2: Calculate the time difference between the corresponding login end time of the previous login behavior and the login start time of the next login behavior in the adjacent login behaviors to obtain the login interval time of any two login behaviors; number the login interval time according to the login time of the corresponding login behavior; obtain a login interval time change curve chart with the number as the horizontal axis and the login interval time as the vertical axis, and perform graphical analysis on the login interval time change curve chart to obtain a cumulative regularity value;

[0069] T3: Divide each day into several time periods. Assign historical login behaviors to several time periods according to the corresponding login start and end times, and perform cumulative analysis of the time periods to obtain the cumulative habit index in each time period.

[0070] T4: retrieve the user's historical login addresses and corresponding historical login times, and classify and analyze all historical login addresses according to the login addresses to obtain the impact values ​​corresponding to each type of login address; record the login index, cumulative regularity value, cumulative habit index in each time period, and the impact value corresponding to each login address as the user's behavior characteristic parameters;

[0071] T5: Perform risk assessment on user login behavior based on user behavior characteristic parameters to generate corresponding security hosting policies; the specific process is as follows:

[0072] When a user successfully logs in to the digital asset network, the user's behavior characteristic parameters are retrieved and the user's login behavior information is obtained, and then numerically analyzed to obtain the risk value of this login;

[0073] When the risk value is greater than or equal to the maximum value in the set risk interval, communication verification is triggered. If the communication verification fails, the user account is locked and enters the locked state. If the communication verification passes, the user account is controlled to enter the display state. When the risk value is within the set risk interval, the user account is controlled to enter the display state. When the risk value is less than the minimum value in the set risk interval, the user account is controlled to enter the unrestricted state, among which the locked state, display state and unrestricted state are all managed policies.

[0074] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A digital asset security custody system based on big data, characterized by: include: Data identification module and security hosting module; The data identification module identifies the user's behavior characteristics based on the user's historical login information to obtain the user's behavior characteristic parameters, where the behavior characteristic parameters include a login index, a cumulative regularity value, a cumulative habit index in each time period, and an influence value corresponding to each login address; The security hosting module performs risk assessment of user login behavior based on the user's behavioral characteristic parameters to generate a corresponding security hosting policy; The specific process is: When a user successfully logs in to the digital asset network, the user's behavior characteristic parameters are retrieved and the user's login behavior information is obtained, where the login behavior information includes the user's login address and login time; the login time is compared with each time period to match the corresponding cumulative habit index, recorded as Fb, and the largest cumulative habit index and the smallest cumulative habit index are selected in each time period, and recorded as Fbmax and Fbmin respectively; the login address is compared with various login addresses to match the corresponding influence value, recorded as Yb; the set formula is used to form The risk value FY of the user's login is calculated, where a1, a2, a3, a4, a5, and a6 are the set weight coefficients, U1 is the set regularity threshold; GK is the cumulative regularity value, and DP is the login index; When the risk value is greater than or equal to the maximum value in the set risk range, communication verification is triggered. If the communication verification fails, the user account is locked and enters the locked state. If the communication verification passes, the user account is controlled to enter the display state. When the risk value is within the set risk range, the user account is controlled to enter the display state. When the risk value is less than the minimum value in the set risk range, the user account is controlled to enter the unrestricted state. The locked state, display state and unrestricted state are all security hosting strategies.

2. The digital asset security custody system based on big data according to claim 1 is characterized in that: The communication verification process is as follows: Step 1: Retrieve the same historical login address as the current login address from the historical login addresses, and arbitrarily select a historical login address with an unrestricted hosting policy, and record the historical login address as the target address; Step 2: retrieve the login address type corresponding to the current login behavior of the user account, and extract the corresponding historical login time from the login address of this type; sort the historical login times in order to obtain a login numerical sequence; identify the position of "0" in the login numerical sequence and record it as a random position; randomly fill the number of "1-9" at the random position; use the random position as a graphic node to divide the login numerical sequence after random filling into several numerical segments, compare and analyze the numerical quantity of the numerical segment with the set numerical interval to match the corresponding value; divide each numerical segment by the matched value to obtain the segment diameter, draw a horizontal line, draw the center of the circle on the horizontal line, and draw a circle with the segment diameter as the diameter to obtain the circle corresponding to each numerical segment, and arrange each circle in the order of the numerical segment to which it belongs in the login numerical sequence and in a tangent manner to obtain the communication graph corresponding to the login address of this type; divide the communication graph into two along the horizontal line, the upper half is used as a verification graph and sent to the target address, and the lower half is sent to the server as a comparison graph for storage; Step 3: Integrate the verification pattern into a communication verification request and send it to the target address. When the verification pattern sent by the target address is received, it is compared with the corresponding comparison pattern. If they match, the communication verification is passed, otherwise the communication verification fails.

3. The digital asset security custody system based on big data according to claim 1 is characterized in that: The feature recognition process of user login behavior is as follows: 301: Retrieve the login start time and login end time of the user, and calculate the time difference between the two to obtain the single login duration; number the single login durations in sequence according to the login time of the corresponding login behavior, and construct a single login duration change curve chart with the number as the horizontal axis and the single login duration as the vertical axis; thereby, perform in-depth analysis on the single login duration change curve chart to obtain a login index; 302: Calculate the time difference between the login end time corresponding to the previous login behavior and the login start time of the next login behavior in adjacent login behaviors to obtain the login interval time between any two login behaviors; number the login interval time according to the login time of the corresponding login behavior; obtain a login interval time change curve graph with the number as the horizontal axis and the login interval time as the vertical axis, and perform graphical analysis on the login interval time change curve graph to obtain a cumulative regularity value; 303: Divide each day into several time periods based on the day as a unit; distribute historical login behaviors into several time periods according to the corresponding login start time and login end time, and perform cumulative analysis on the time periods to obtain the cumulative habit index in each time period; 304: Retrieve the user's historical login addresses and corresponding historical login times, and classify and analyze all historical login addresses according to the login addresses to obtain the impact values ​​corresponding to each type of login address.

4. The digital asset security custody system based on big data according to claim 3 is characterized in that: The specific process of in-depth analysis of the single login duration change curve to obtain the login index is as follows: Draw tangents of the curve at interval points in the curve, and calculate the slope of the tangent to obtain the slope corresponding to each interval point; record the slope greater than zero as the increasing slope, and take the absolute value of the slope less than zero as the decreasing slope; compare and analyze the increasing slope with the set increasing range to obtain the first-level increasing slope, the second-level increasing slope and the third-level increasing slope; Compare and analyze the decline slope with the decline range to divide the decline slope into the first-level decline slope, the second-level decline slope and the third-level decline slope; count the number of the first-level increase slope, the second-level increase slope and the third-level increase slope respectively, and record them as X1, X2 and X3 respectively; sum the first-level increase slope, the second-level increase slope and the third-level increase slope to obtain the first-level increase value, the second-level increase value and the third-level increase value, and record them as X4, X5 and X6 respectively; When the increasing slope is greater than the maximum value in the set increasing range, the increasing slope is recorded as the first-level increasing slope; when the increasing slope is within the set increasing range, the increasing slope is recorded as the second-level increasing slope; when the increasing slope is less than the minimum value in the set increasing range, the increasing slope is recorded as the third-level increasing slope; the number of the first-level decreasing slope, the second-level decreasing slope and the third-level decreasing slope are counted respectively, and they are recorded as P1, P2 and P3 respectively; the first-level decreasing slope, the second-level decreasing slope and the third-level decreasing slope are summed to obtain the first-level decreasing value, the second-level decreasing value and the third-level decreasing value, and they are recorded as P4, P5 and P6 respectively; X1, X2, X3, X4, X5, X6, P1, P2, P3, P4, P5 and P6 are set by the formula The login index DP is calculated, where q1, q2, q3, q4, q5, and q6 are set weight coefficients, and e is a natural constant.

5. The digital asset security custody system based on big data according to claim 4 is characterized in that: The specific process of graphical analysis of the login interval duration change curve is as follows: Draw a tangent line of the curve at the interval point, use data fitting to get the tangent expression, and perform differentiation operation on the tangent expression to get the tangent derivative at each interval point, recorded as Ki, where i = 1, 2, 3 ... I, I is a positive integer, I represents the largest number in the numbering, and i represents any number among them; sum up the derivatives greater than zero to get the interval increase, recorded as G1, sum up the derivatives less than zero and take the absolute value to get the interval decrease, recorded as G2; use the set formula The cumulative regularity value GK is calculated, where b1, b2, and b3 are the set weight coefficients. It represents the mean value of the derivative at each interval point. It represents the mean slope of each login point, and Fi represents the slope corresponding to each interval point.

6. The digital asset security custody system based on big data according to claim 5 is characterized in that: The specific process of cumulative analysis of time periods is as follows: Randomly select a time period, count the cumulative number of logins in the time period, and sum up the login durations corresponding to the cumulative number of logins in the time period to obtain the cumulative login duration; The cumulative number of logins and the cumulative login duration in each time period are calculated and analyzed in a formula to obtain the cumulative habit index in each time period; Retrieve the user's historical login addresses and the corresponding historical login times, and classify all historical login addresses according to the login addresses; randomly select one category of login addresses, the historical login addresses and the corresponding historical login times in this category of login addresses, calculate the time difference between the historical login time and the current time of the system to obtain the time difference as the influencing factor of the historical login address, and calculate the mean value to obtain the influencing factor of the category of login addresses; count the number of historical login addresses in the same category, and perform formulaic calculation and analysis on it and the influencing factors of each category of login addresses to obtain the corresponding influencing values ​​of each category of login addresses.

7. A digital asset security custody method based on big data, characterized in that Applied to the digital asset security custody system based on big data as described in any one of claims 1 to 6, the method comprises the following steps: 701: Retrieve the login start time and login end time of the user, and calculate the time difference between the two to obtain the single login duration; number the single login durations in sequence according to the login time of the corresponding login behavior, and construct a single login duration change curve chart with the number as the horizontal axis and the single login duration as the vertical axis; thereby, perform in-depth analysis on the single login duration change curve chart to obtain a login index; 702: Calculate the time difference between the login end time corresponding to the previous login behavior and the login start time of the next login behavior in adjacent login behaviors to obtain the login interval time between any two login behaviors; number the login interval time according to the login time of the corresponding login behavior; obtain a login interval time change curve graph with the number as the horizontal axis and the login interval time as the vertical axis, and perform graphical analysis on the login interval time change curve graph to obtain a cumulative regularity value; 703: Taking a day as a unit, divide each day into several time periods; distribute historical login behaviors into several time periods according to corresponding login start time and login end time, and make cumulative analysis of the time periods to obtain the cumulative habit index in each time period; 704: Retrieve the historical login addresses and corresponding historical login times of the user, and classify and analyze all historical login addresses according to the login addresses to obtain the influence values ​​corresponding to each login address; record the login index, the cumulative regularity value, the cumulative habit index in each time period, and the influence value corresponding to each login address as the user's behavior characteristic parameters; 705: Perform risk assessment on the user's login behavior based on the user's behavior characteristic parameters to generate a corresponding security trusteeship policy; the specific process is as follows: When a user successfully logs in to the digital asset network, the user's behavior characteristic parameters are retrieved and the user's login behavior information is obtained, and then numerically analyzed to obtain the risk value of this login; When the risk value is greater than or equal to the maximum value in the set risk interval, communication verification is triggered. If the communication verification fails, the user account is locked and enters the locked state. If the communication verification passes, the user account is controlled to enter the display state. When the risk value is within the set risk interval, the user account is controlled to enter the display state. When the risk value is less than the minimum value in the set risk interval, the user account is controlled to enter the unrestricted state, among which the locked state, display state and unrestricted state are all managed policies.

Images