An information security management and monitoring system based on big data

Abstract

The present application discloses an information security management and monitoring system based on big data, which relates to the field of information security technology, including a server, a security monitoring module and a security management module; the security monitoring module monitors the new status of various types of data and calculates the data addition rate, so that the system can dynamically identify the growth trend of sensitive data; the TF-IDF algorithm is used to identify keywords in the data, and the sensitivity of each data segment is quantified accordingly, and a segment sensitivity value is generated and sent to the security management module; the security management module can effectively identify potential internal security threats through a comprehensive analysis of user access behavior types, device confidence coefficients and data sensitivity. When the risk of user behavior increases, access rights will be gradually restricted and eventually completely locked to prevent high-risk users from accessing highly sensitive data; the monitoring and management capabilities of internal campus security threats are significantly improved, and the risk of data leakage is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security management and monitoring system based on big data. Background Art

[0002] With the rapid development of information technology, the amount of data on university campuses has grown exponentially, covering student information, teaching resources, scientific research data, financial records, etc. In order to ensure the security, integrity and availability of this data, campus security monitoring management is particularly important;

[0003] At present, the security monitoring of campus information mainly focuses on the monitoring and management of external network attacks (such as DDoS attacks, malware, etc.), while the monitoring and management of internal security threats (human errors, malicious behavior of internal personnel, etc.) are insufficient, resulting in an increased risk of data leakage, especially the school's scientific research data, which may cause great damage to the school once leaked. Summary of the invention

[0004] The purpose of the present invention is to solve the problems mentioned in the above background technology and to propose an information security management and monitoring system based on big data.

[0005] The purpose of the present invention can be achieved through the following technical solutions: An information security management and monitoring system based on big data; including a server, a security monitoring module and a security management module;

[0006] The security monitoring module monitors and analyzes the data volume of various types of data in the school to obtain the data addition rate, divides each type of data into several data segments, analyzes the sensitivity of each data segment in combination with the data addition rate, obtains the segment sensitivity value of each data segment, and sends it to the security management module;

[0007] The security management module monitors and regulates the access behavior of each authorized user on campus based on the segment sensitivity value corresponding to each data segment in each type of data, specifically:

[0008] Step 1: When authorized users of various types log in to the campus website through devices to view data of corresponding types, obtain the authorized user's behavior data and historical login data of the device number, where the behavior data includes the number of behaviors and the behavior type, segment sensitivity value and behavior volume corresponding to each behavior;

[0009] Step 2: Perform confidence analysis based on the historical login records of each device to obtain the confidence coefficient of each device, denoted as δ;

[0010] Step 3: Set a behavior base value for each behavior type, and compare the behavior type with all the set behavior types to match the corresponding behavior base value; thus, the segment sensitivity value Mβ, the behavior amount L, the behavior base value P, and the confidence coefficient δ of the device used for this login can be substituted into the set formula Calculate the behavior risk value PL of each behavior, where η1, η2, and η3 are the set weight coefficients respectively; accumulate the behavior risk values ​​corresponding to each behavior to obtain the cumulative risk value;

[0011] Step 4: Set each type of data to correspond to a permission range value range. When the segment sensitivity value of each data segment is compared and analyzed with the permission range of the corresponding type, when the segment sensitivity value of the data segment is greater than the maximum value in the set permission range, the data segment is recorded as a high-privilege data segment; when the segment sensitivity value of the data segment is within the set permission range, the data segment is recorded as a medium-privilege data segment; when the segment sensitivity value of the data segment is less than the minimum value in the set permission range, the data segment is recorded as a low-privilege data segment;

[0012] Step 5: Set three risk thresholds, namely risk threshold 1, risk threshold 2 and risk threshold 3, and risk threshold 1> risk threshold 2> risk threshold 3> 0; if the cumulative risk value is less than risk threshold 3, there is no need to trigger any security protection measures; when the cumulative risk value is greater than risk threshold 3 and less than risk threshold 2, the authorized user is allowed to access low-sensitivity data segments and medium-sensitivity data segments; when the cumulative risk value is greater than risk threshold 2 and less than risk threshold 1, the authorized user is allowed to access low-sensitivity data segments; when the cumulative risk value is greater than risk threshold 1, the authorized user is locked and is not allowed to access any data segment.

[0013] As a preferred implementation of the present invention, the specific process of performing confidence analysis based on the historical login records of each device is as follows:

[0014] 201: Retrieve the historical login record of the device, wherein the historical login record includes the number of historical logins and the type of authorized user, login IP address, and login time of each login;

[0015] 202: Perform time dispersion analysis based on the login time of the historical login times to obtain a time dispersion value;

[0016] 203: Perform geographic location dispersion analysis based on the login IP address of the historical login times to obtain a location dispersion value;

[0017] 204: Count the total number of authorized user types in the historical login records of the device room and record it as N, and substitute it, the time dispersion value Cd, and the location dispersion value Rd into the set formula The confidence coefficient is calculated, where λ1, λ2, and λ3 are the set weight coefficients respectively; thus, the confidence coefficient δ of each device can be obtained.

[0018] As a preferred embodiment of the present invention, the specific process of performing time dispersion analysis based on the login time of the historical login times is as follows:

[0019] Based on the 24 hours of a day, the 24 hours of a day are divided into several time periods. The historical login times are accumulated in each time period according to their corresponding login time. In this way, the cumulative login times of each time period can be obtained. If the cumulative login times in a time period is greater than zero, the time period is recorded as a valid time period. The cumulative login times corresponding to the valid time period are recorded as Ck, where k=1,2,3...K, K is a positive integer, K is the total number of valid time periods, and k is the serial number of any valid time period; using the set formula Calculate the time dispersion value Cd, It is the average of the corresponding cumulative number of logins in each time period.

[0020] As a preferred implementation of the present invention, the specific process of performing geographical location dispersion analysis based on the login IP address of the historical login times is as follows:

[0021] Sort the login IP addresses of each login frequency according to their corresponding login time, identify each login IP address, and calculate the geographical location distance between two adjacent login IP addresses. If the geographical location distance is greater than zero, the geographical location distance is recorded as the effective distance, and the number of effective distances is recorded as R1; calculate the average distance of each effective distance and record it as R2. Use the set formula The position dispersion value Rd is calculated, where µ1 and µ2 are the set weight coefficients respectively.

[0022] As a preferred embodiment of the present invention, the specific process of monitoring and analyzing the newly added state of data volume of various types of data in the school is as follows:

[0023] The amount of newly added data in each type of data is retrieved and recorded as Zi, where i=1,2,3…I, I is a positive integer, I is the total number of acquisition moments, and i is the sequence number of any acquisition moment; a two-dimensional rectangular coordinate system is constructed with time as the horizontal coordinate and the amount of newly added data as the vertical coordinate, and the amount of newly added data is input into the coordinate axis according to its corresponding acquisition moment to obtain a number of data points, which are connected in sequence with line segments to obtain a curve graph of the amount of newly added data changing with time; the time difference between two adjacent acquisition moments is calculated to obtain a time interval recorded as ; Using the set formula Calculate the trend value of the line segment composed of two adjacent data points ;

[0024] Select the change trend values ​​that are greater than zero and record them as increasing trend values, thereby obtaining several increasing trend values; compare and analyze the increasing trend values ​​with the set trend interval to divide the increasing trend values ​​into a primary increasing trend, a secondary increasing trend and a tertiary increasing trend; count the cumulative numbers of the primary increasing trend, the secondary increasing trend and the tertiary increasing trend respectively, and record them as S1, S2 and S3 respectively;

[0025] Change trend value , the amount of new data Zi, the cumulative number of the first-level increasing trend S1, the cumulative number of the second-level increasing trend S2, and the cumulative number of the third-level increasing trend S3 are substituted into the set formula The data addition degree Sα is calculated, where are the set weight coefficients and α1>α2>α3>1; thus, the data addition degree corresponding to each type of data can be obtained.

[0026] As a preferred implementation of the present invention, the specific process of dividing each type of data into several data segments and performing sensitivity analysis on each data segment in combination with the degree of data addition is as follows:

[0027] Each type of data on the device corresponds to a number of authorized users of the same type, and each type of data is split into several data segments; each type of data is set to correspond to a number of keywords, and each keyword corresponds to a key value;

[0028] Randomly select one type of data, and compare its corresponding data segment with each keyword to obtain the number of keywords in the data segment and the key value corresponding to each keyword; use the TF-IDF algorithm to calculate the importance score of each keyword in the data segment; normalize the key value and importance score of each keyword and take its value, and perform weighted calculation on the value to obtain the sensitivity value corresponding to each keyword;

[0029] Compare and analyze the sensitivity value of each keyword in the data segment with the set sensitivity interval to divide the keywords corresponding to the sensitivity value into highly sensitive words, moderately sensitive words and slightly sensitive words, respectively count the number of highly sensitive words, moderately sensitive words and slightly sensitive words in the data segment, and record them as M1, M2 and M3 respectively; sum the sensitivity values ​​corresponding to the highly sensitive words, moderately sensitive words and slightly sensitive words to obtain the highly sensitive value, moderately sensitive value and slightly sensitive value, and record them as M4, M5 and M6 respectively;

[0030] Substitute Sα, M1, M2, M3, M4, M5 and M6 into the given formula The segment sensitivity value Mβ of the data segment, where β1, β2, and β3 are the set weight coefficients respectively, and β1>β2>β3>1; thus, the segment sensitivity value corresponding to each data segment in each type of data can be obtained and sent to the security management module.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] By monitoring the new status of each type of data and calculating the data addition rate, the system can dynamically identify the growth trend of sensitive data; using the TF-IDF algorithm to identify keywords in the data, and based on this, quantify the sensitivity of each data segment and generate a segment sensitivity value; based on the segment sensitivity value of each data segment, the system can evaluate the sensitivity of the data and provide a reference for different user access behaviors, thereby implementing more targeted security protection strategies. Such a mechanism can more effectively protect sensitive data, especially when data is added quickly, ensuring that data of different sensitivity levels are appropriately protected;

[0033] Through comprehensive analysis of user access behavior types, device confidence coefficients, and data sensitivity, potential internal security threats can be effectively identified to ensure that user behavior meets data security level requirements. When user behavior risks increase, access rights will be gradually restricted and eventually completely locked to prevent high-risk users from accessing highly sensitive data. The ability to monitor and manage internal campus security threats has been significantly improved, effectively reducing the risk of data leakage, especially greatly enhancing the protection of core assets such as scientific research data. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0035] Figure 1 This is the overall system block diagram of the present invention. DETAILED DESCRIPTION

[0036] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] See also Figure 1 As shown, an information security management and monitoring system based on big data includes: a server, a security monitoring module and a security management module;

[0038] The server stores various types of school data, device history login data, and authorized user behavior data; the various types of data include scientific research data, student data, teacher data, academic data, financial data, etc.

[0039] The security monitoring module monitors and analyzes the data volume of various types of data in the school to obtain the data addition rate, divides each type of data into several data segments, and analyzes the sensitivity of each data segment based on the data addition rate to obtain the segment sensitivity value of each data segment, specifically:

[0040] The amount of new data in each type of data is retrieved and recorded as Zi, where i=1,2,3…I, I is a positive integer, I is the total number of acquisition moments, and i is the sequence number of any acquisition moment; a two-dimensional rectangular coordinate system is constructed with time as the horizontal coordinate and the amount of new data as the vertical coordinate, and the amount of new data is input into the coordinate axis according to its corresponding acquisition moment to obtain a number of data points, which are connected in sequence using line segments to obtain a curve graph of the amount of new data changing with time; thus, the coordinates of each data point are recorded as (i, Zi); the time interval obtained by calculating the time difference between two adjacent acquisition moments is recorded as ; Using the set formula Calculate the trend value of the line segment composed of two adjacent data points ; It should be noted that when the change trend is greater than zero, it means that the amount of new data is increasing. The larger the change trend value, the greater the increase in the amount of new data, which usually means that the demand for data protection will also increase; the risk of data leakage increases, and more stringent data protection measures are needed. For example, the increase in scientific research projects or the opening of new courses and research fields will lead to a rapid growth of related data; when the change trend is less than zero, it means that the amount of new data is decreasing;

[0041] Select the change trend value greater than zero and record it as the increasing trend value, thereby obtaining several increasing trend values; compare and analyze the increasing trend value with the set trend interval. When the increasing trend value is greater than the upper limit of the set trend interval, a first-level increasing trend is accumulated; when the increasing trend value is in the set trend interval, a second-level increasing trend is accumulated; when the increasing trend value is less than the lower limit of the set trend interval, a third-level increasing trend is accumulated; count the cumulative number of the first-level increasing trend, the second-level increasing trend and the third-level increasing trend respectively, and record them as S1, S2 and S3 respectively; use the set formula The data addition rate Sα is calculated, where are the set weight coefficients, and α1>α2>α3>1; thus, the data addition rate corresponding to each type of data can be obtained;

[0042] By monitoring the new status of each type of data and calculating the rate of data addition, the growth trend of sensitive data can be dynamically identified, especially in important fields such as scientific research and finance. When the amount of new data increases significantly, it often means that the potential risk of data leakage is also increasing, so protection measures need to be strengthened.

[0043] Each type of data of the device corresponds to several authorized users of the same type. For example, the authorized users corresponding to the school's financial data are financial users, and the authorized users corresponding to the scientific research data are scientific research users. Each type of data is divided into several data segments. For example, scientific research data is divided into several data segments according to its different scientific research projects. Each type of data is set to correspond to several keywords, and each keyword corresponds to a key value. For example, the keywords included in scientific research data include scientific research funds, scientific research projects, scientific research content, scientific research progress and scientific research results. Different scientific research funds correspond to different key values. The more scientific research funds there are, the larger the corresponding key value is. The specific keywords of each type and the key values ​​corresponding to the keywords are set by technical personnel in this field according to the actual situation of the school.

[0044] Randomly select one type of data, and compare its corresponding data segment with each keyword to obtain the number of keywords in the data segment and the key value corresponding to each keyword; use the TF-IDF (term frequency-inverse document frequency) algorithm to calculate the importance score of each keyword in the data segment; normalize the key value and importance score of each keyword and take its numerical value, and perform weighted calculation on the numerical value to obtain the sensitivity value corresponding to each keyword. From the calculation process of the sensitivity value of each keyword, it can be seen that when the importance score of the keyword in the data segment is larger and the key value is larger, the sensitivity value corresponding to the keyword is larger, which means that the sensitivity of the data segment is greater;

[0045] Compare and analyze the sensitivity value of each keyword in the data segment with the set sensitivity interval. When the sensitivity value is greater than the maximum value in the set sensitivity interval, a highly sensitive word is accumulated; when the sensitivity value is in the set sensitivity interval, a moderately sensitive word is accumulated; when the sensitivity value is less than the minimum value in the set sensitivity interval, a mildly sensitive word is accumulated; the number of highly sensitive words, moderately sensitive words and mildly sensitive words in the data segment is counted respectively, and they are recorded as M1, M2 and M3 respectively; the sensitivity values ​​corresponding to highly sensitive words, moderately sensitive words and mildly sensitive words are summed up to obtain highly sensitive values, moderately sensitive values ​​and mildly sensitive values, and they are recorded as M4, M5 and M6 respectively; use the set formula The segment sensitivity value Mβ of the data segment, where β1, β2, and β3 are respectively the set weight coefficients, and β1>β2>β3>1; thus, the segment sensitivity value corresponding to each data segment in each type of data can be obtained and sent to the security management module;

[0046] By monitoring the status of new additions to each type of data and calculating the rate at which new data is added, the system can dynamically identify the growth trend of sensitive data. It uses the TF-IDF algorithm to identify keywords in the data and quantify the sensitivity of each data segment to generate a segment sensitivity value. Based on the segment sensitivity value of each data segment, the system can evaluate the sensitivity of the data and provide a reference for different user access behaviors, thereby implementing more targeted security protection strategies. Such a mechanism can more effectively protect sensitive data, especially when data is added quickly, ensuring that data of different sensitivity levels are given corresponding security protection.

[0047] The security management module monitors and regulates the access behavior of each authorized user on campus based on the segment sensitivity value corresponding to each data segment in each type of data to ensure that data of different sensitivities are protected at the corresponding level during access on campus, thereby reducing the risk of data leakage and achieving effective monitoring and regulation of access behavior; specifically:

[0048] When authorized users of various types log in to the campus website through devices to view data of corresponding types, the behavior data of authorized users and historical login data of device numbers are obtained, where the behavior data includes the number of behaviors and the behavior type, segment sensitivity value and behavior volume corresponding to each behavior; specific behavior types include behavior viewing, downloading, modifying and deleting behaviors, etc. The segment sensitivity value refers to the segment sensitivity value of the data of this behavior, and the larger the segment sensitivity value, the more sensitive the behavior is; the behavior volume refers to the amount of data involved in this behavior, such as the amount of viewed data corresponding to viewing behavior, the amount of downloaded data corresponding to downloading behavior, etc.;

[0049] Different behavior types are set to correspond to a behavior base value. It should be noted that the behavior base value corresponding to the behavior type represents the basic risk value corresponding to the behavior. For example, the behavior base value corresponding to the modification behavior is greater than the behavior base value corresponding to the deletion behavior, and the behavior base value corresponding to the deletion behavior is greater than the behavior base value corresponding to the download behavior; the behavior base value corresponding to the download behavior is greater than the behavior base value corresponding to the viewing behavior; the behavior type is compared with all the set behavior types to match the corresponding behavior base value, and it is recorded as P; thereby, the segment sensitivity value Mβ of the data corresponding to each new behavior and the behavior amount are recorded as L; using the set formula The behavior risk value PL of each behavior is calculated, where η1, η2, and η3 are the set weight coefficients, and δ is the confidence coefficient of the device used by the authorized user to log in this time. It can be seen from the formula that when the behavior base value and the segment sensitivity value corresponding to this behavior are larger, the behavior volume is larger, indicating that the risk of this behavior is greater, and the behavior risk value is larger; the behavior risk values ​​corresponding to each behavior are accumulated and calculated to obtain the risk cumulative value;

[0050] The analysis process of the confidence coefficient of the equipment is:

[0051] Retrieve the historical login records of the device, where the historical login records include the number of historical logins and the type of authorized user for each login, login IP address, and login time. It should be noted that if the same device logs in to different types of authorized accounts, it means that the device is shared by multiple users (such as multiple people using the same device to log in to different accounts). The confidence level is usually low because it is difficult to accurately determine the identity of the device user. When the device's login IP address changes frequently, it means that the device is used in different network environments, especially public networks or unknown networks. This behavior increases potential security risks, especially when the login IP address comes from a place with a large geographical span, which means that the identity or security of the device is threatened.

[0052] Based on the 24 hours of a day, the 24 hours of a day are divided into several time periods. The historical login times are accumulated in each time period according to their corresponding login time. In this way, the cumulative login times of each time period can be obtained. If the cumulative login times in a time period is greater than zero, the time period is recorded as a valid time period. The cumulative login times corresponding to the valid time period are recorded as Ck, where k=1,2,3...K, K is a positive integer, K is the total number of valid time periods, and k is the serial number of any valid time period; using the set formula Calculate the time dispersion value Cd, is the average of the corresponding cumulative number of logins in each time period. As can be seen from the formula, the more unbalanced the cumulative number of logins within the valid time period of the device is, the more disordered the login time of the device is, and the larger the time dispersion value is, the lower the confidence level of the device is.

[0053] Sort the login IP addresses of each login frequency according to their corresponding login time, identify each login IP address, and calculate the geographical location distance between two adjacent login IP addresses. If the geographical location distance is greater than zero, the geographical location distance is recorded as the effective distance, and the number of effective distances is recorded as R1; calculate the average distance of each effective distance and record it as R2. Use the set formula The location dispersion value Rd is calculated, where µ1 and µ2 are the set weight coefficients. It can be seen from the formula that the more dispersed the geographical locations of the device's historical login IP addresses are (the greater the distance between the login IP addresses), the greater the location dispersion value, and the greater the risk of the device.

[0054] Count the total number of authorized user types in the historical login records of the device room and record it as N; use the set formula The confidence coefficient is calculated, where λ1, λ2, and λ3 are the set weight coefficients respectively; thus, the confidence coefficient δ of each device can be obtained;

[0055] Each type of data is set to correspond to a permission interval. When the segment sensitivity value of each data segment is compared and analyzed with the permission interval of the corresponding type, when the segment sensitivity value of the data segment is greater than the maximum value in the set permission interval, the data segment is recorded as a high-authority data segment; when the segment sensitivity value of the data segment is within the set permission interval, the data segment is recorded as a medium-authority data segment; when the segment sensitivity value of the data segment is less than the minimum value in the set permission interval, the data segment is recorded as a low-authority data segment;

[0056] There are three risk thresholds set, namely, risk threshold 1, risk threshold 2 and risk threshold 3, and risk threshold 1> risk threshold 2> risk threshold 3> 0; if the cumulative risk value is less than risk threshold 3, it means that the risk of the authorized user is very small and can be ignored, and there is no need to trigger any security protection measures; when the cumulative risk value is greater than risk threshold 3 and less than risk threshold 2, the authorized user is allowed to access low-sensitivity data segments and medium-sensitivity data segments; when the cumulative risk value is greater than risk threshold 2 and less than risk threshold 1, the authorized user is allowed to access low-sensitivity data segments; when the cumulative risk value is greater than risk threshold 1, the authorized user is locked and is not allowed to access any data segments;

[0057] Through comprehensive analysis of user access behavior types, device confidence coefficients, and data sensitivity, potential internal security threats can be effectively identified to ensure that user behavior meets data security level requirements. When user behavior risks increase, access rights will be gradually restricted and eventually completely locked to prevent high-risk users from accessing highly sensitive data. The ability to monitor and manage internal campus security threats has been significantly improved, effectively reducing the risk of data leakage, especially greatly enhancing the protection of core assets such as scientific research data.

[0058] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An information security management and monitoring system based on big data, characterized in that: Including server, security monitoring module and security management module; The security monitoring module monitors and analyzes the data volume of various types of data in the school to obtain the data addition rate, divides each type of data into several data segments, analyzes the sensitivity of each data segment in combination with the data addition rate, obtains the segment sensitivity value of each data segment, and sends it to the security management module; The security management module monitors and regulates the access behavior of each authorized user on campus based on the segment sensitivity value corresponding to each data segment in each type of data, specifically: Step 1: When authorized users of various types log in to the campus website through devices to view data of corresponding types, obtain the authorized user's behavior data and historical login data of the device number, where the behavior data includes the number of behaviors and the behavior type, segment sensitivity value and behavior volume corresponding to each behavior; Step 2: Perform confidence analysis based on the historical login records of each device to obtain the confidence coefficient of each device; Step 3: Compare the behavior type with all the set behavior types to match the corresponding behavior base value; The segment sensitivity value, behavior volume, behavior base value of the data corresponding to each new behavior and the confidence coefficient of the device used for this login are analyzed to obtain the behavior risk value of each behavior; The behavior risk values ​​corresponding to each behavior are accumulated and calculated to obtain the cumulative risk value; Step 4: Compare and analyze the segment sensitivity value of each data segment with the corresponding type of permission interval to obtain high-privilege data segments, medium-privilege data segments, and low-privilege data segments; Step 5: When the cumulative risk value is greater than risk threshold 3 and less than risk threshold 2, the authorized user is allowed to access the low-sensitivity data segment and the medium-sensitivity data segment; When the cumulative risk value is greater than risk threshold 2 and less than risk threshold 1, the user with this permission is allowed to access the low-sensitivity data segment; When the cumulative risk value is greater than the risk threshold 1, the authorized user will be locked and will not be allowed to access any data segment.

2. According to the big data-based information security management and monitoring system of claim 1, it is characterized in that: The specific process of confidence analysis based on the historical login records of each device is as follows: 201: Retrieve the historical login record of the device, wherein the historical login record includes the number of historical logins and the type of authorized user, login IP address, and login time of each login; 202: Perform time dispersion analysis based on the login time of the historical login times to obtain a time dispersion value; 203: Perform geographic location dispersion analysis based on the login IP address of the historical login times to obtain a location dispersion value; 204: Count the total number of authorized user types in the historical login records on the device, normalize the total number with the time dispersion value and the location dispersion value, and take the numerical value, and analyze the numerical value to obtain the confidence coefficient; thus, the confidence coefficient of each device can be obtained.

3. The information security management and monitoring system based on big data according to claim 2 is characterized in that: The specific process of time dispersion analysis based on the login time of historical login times is as follows: Based on the 24 hours of a day, the 24 hours of a day are divided into several time periods. The historical login times are accumulated in each time period according to their corresponding login time. In this way, the cumulative login times of each time period can be obtained. If the cumulative login times in a time period is greater than zero, the time period is recorded as a valid time period. The cumulative login times corresponding to the valid time period are recorded as Ck, where k=1,2,3...K, K is a positive integer, K is the total number of valid time periods, and k is the serial number of any valid time period; using the set formula Calculate the time dispersion value Cd, It is the average of the corresponding cumulative number of logins in each time period.

4. The information security management and monitoring system based on big data according to claim 3 is characterized in that: The specific process of geographical location dispersion analysis based on the login IP address of historical login times is as follows: Sort the login IP addresses of each login frequency according to their corresponding login time, identify each login IP address, and calculate the geographical location distance between two adjacent login IP addresses. If the geographical location distance is greater than zero, the geographical location distance is recorded as the effective distance, and the number of effective distances is recorded as R1; calculate the average distance of each effective distance and record it as R2. Use the set formula The position dispersion value Rd is calculated, where µ1 and µ2 are the set weight coefficients respectively.

5. The information security management and monitoring system based on big data according to claim 1 is characterized in that: The specific process of monitoring and analyzing the newly added status of various types of data in the school is as follows: Retrieve the amount of newly added data in each type of data and record it as Zi, where i=1,2,3...I, I is a positive integer, I is the total number of collection moments, and i is the sequence number of any one of them; A two-dimensional rectangular coordinate system is constructed with time as the horizontal axis and the amount of new data as the vertical axis. The amount of new data is input into the coordinate axis according to its corresponding collection time to obtain several data points, which are connected in sequence using line segments to obtain a curve graph of the amount of new data changing with time; the time difference between two adjacent collection times is calculated to obtain the time interval recorded as ; Using the set formula Calculate the trend value of the line segment composed of two adjacent data points ; Select the change trend values ​​that are greater than zero and record them as increasing trend values, thereby obtaining several increasing trend values; Compare and analyze the increasing trend value with the set trend interval to divide the increasing trend value into a primary increasing trend, a secondary increasing trend and a tertiary increasing trend; count the cumulative number of the primary increasing trend, the secondary increasing trend and the tertiary increasing trend respectively; The change trend value, the amount of new data, the cumulative number of the first-level increase trend, the second-level increase trend and the third-level increase trend are normalized and their values ​​are taken, and the data addition degree is obtained by numerical analysis; thereby, the data addition degree corresponding to each type of data can be obtained.

6. The information security management and monitoring system based on big data according to claim 5 is characterized in that: The specific process of dividing each type of data into several data segments and performing sensitivity analysis on each data segment in combination with the degree of data addition is as follows: Each type of data on the device corresponds to a number of authorized users of the same type, and each type of data is split into several data segments; each type of data is set to correspond to a number of keywords, and each keyword corresponds to a key value; Randomly select one type of data, and compare its corresponding data segment with each keyword to obtain the number of keywords in the data segment and the key value corresponding to each keyword; use the TF-IDF algorithm to calculate the importance score of each keyword in the data segment; normalize the key value and importance score of each keyword and take its value, and perform weighted calculation on the value to obtain the sensitivity value corresponding to each keyword; Compare and analyze the sensitivity value of each keyword in the data segment with the set sensitivity interval to classify the keywords corresponding to the sensitivity value into highly sensitive words, moderately sensitive words and mildly sensitive words, respectively count the number of highly sensitive words, moderately sensitive words and mildly sensitive words in the data segment, and sum the sensitivity values ​​corresponding to the highly sensitive words, moderately sensitive words and mildly sensitive words to obtain the highly sensitive value, moderately sensitive value and mildly sensitive value respectively; The data addition degree, the number of severely sensitive words, the number of moderately sensitive words, the number of mildly sensitive words, the severely sensitive value, the moderately sensitive value and the mildly sensitive value are formulated and analyzed to obtain the segment sensitivity value of the data segment; thereby, the segment sensitivity value corresponding to each data segment in each type of data can be obtained and sent to the security management module.

Images